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ABSTRACT 

We  present  GS3,  a  distributed,  scalable,  self-configuration  and  self-healing 
algorithm  for  multi-hop  wireless  networks.  The  algorithm  enables  network  nodes  in  a 
2D  plane  to  configure  themselves  into  a  cellular  hexagonal  structure  such  that  cells 
have  tightly  bounded  geographic  radius  and  low  overlap  between  neighboring  cells. 
The  structure  is  self-healing  under  various  perturbations,  such  as  node  joins,  leaves, 
deaths,  movements,  and  state  corruptions.  For  instance,  it  slides  as  a  whole  if  nodes 
in  many  cells  die  at  the  same  rate.  Moreover,  its  configuration  and  healing  are 
scalable  in  three  respects:  first,  local  knowledge  enables  each  node  to  maintain  only 
limited  information  with  respect  to  a  constant  number  of  nearby  nodes;  second,  local 
heeding  guarantees  that  all  perturbations  are  contained  within  a  tightly  bounded 
region  with  respect  to  the  perturbed  area  and  dealt  with  in  a  one-way  message 
diffusion  time  across  the  region;  third,  only  local  coordination  is  needed  in  both 
configuration  and  self-healing. 
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1.  INTRODUCTION 

As  increasingly  small  network  nodes  are  becoming 
available,  many  “sense-compute-actuate”  networks  are 
being  realized.  Several  of  these  networks  use 
unattended  wireless  nodes  [1,2,4],  which  communicate 
with  one  another  via  intermediate  node  relays  due  to 
limited  transmission  range  or  energy  [7,8].  The  number 
of  nodes  is  potentially  large  (thousands  and  millions  of 
nodes  are  considered  in  earthquake  relief  and 
unmanned  space  vehicle  scenarios,  for  instance)  [1], 
Thus,  scalability  is  a  key  issue  for  large-scale  multi-hop 
wireless  networks. 

One  way  to  achieve  scalability  is  by  “divide  and 
conquer”,  or  hierarchical  control.  Network  nodes  are 
first  grouped  into  a  set  of  clusters  by  some  clustering 
criterion.  A  leader  is  elected  in  each  cluster  to  represent 
the  cluster  at  higher  levels.  The  same  clustering  scheme 
may  be  iteratively  applied  to  the  cluster  leaders  to  form 
a  hierarchy.  In  this  hierarchy,  local  control  is  applied  at 
each  level  to  achieve  some  global  objective. 

Most  previous  work  on  clustering  [3,12]  treats  a 
network  as  a  geography-unaware  graph.  The  clustering 
criteria  adopted  are,  for  instance,  the  number  of  nodes 
in  a  cluster  and  the  cluster  size.  These  criteria  do  not 
take  the  geographic  radius  of  clusters  (simply  called 
radius,  henceforth)  into  account,  which  we  argue  is 
desirable  in  wireless  networks,  especially  in  large- 
scale,  resource  constrained  multi -hop  networks:  1) 
many  multi-hop  wireless  network  applications,  such  as 
environment  monitoring  and  temperature  sensing,  are 
inherently  geography-aware  and  so  reflecting 
geography  in  the  underlying  structure  enables 
optimization  of  system  performance.  2)  Cluster  radius 
affects  energy  dissipated  for  intra  cluster  coordination 
and  thus  the  lifetime  of  a  network.  3)  Cluster  radius 
affects  the  efficiency  of  local  coordination  functions 
such  as  data  aggregation  and  load  balancing.  4)  Cluster 
radius  affects  the  quality  of  communication  over  a 
shared  wireless  transmission  medium;  also,  the  larger 
the  cluster  radius,  the  less  the  frequency  reuse.  5) 
Cluster  radius  affects  the  scalability  and  availability  of 
a  network,  since  it  affects  the  number  of  clusters  and 
the  number  of  nodes  in  each  cluster  (the  more  the 
nodes  in  a  cluster,  the  more  available  the  cluster  is). 

Moreover,  given  that  expected  multi-hop  wireless 
networks  are  of  large  scale,  they  are  subject  to  node 
failure,  node  join  and  leave,  mobility,  and  state 
corruption,  and  they  usually  cannot  be  managed 
manually  [5],  self-configuration  and  self-healing  is 
necessary  in  multi-hop  wireless  networks. 

Contributions  of  the  paper  In  this  paper,  we 
present  a  distributed  algorithm  (GS3)  for  configuring  a 


wireless  locally  planar  network  into  clusters  (which  we 
henceforth  call  cells  due  to  their  geographic  nature.) 
More  specifically,  the  network  nodes  configure 
themselves  into  a  cellular  hexagonal  structure,  in 
which  the  network  nodes  are  partitioned  into  hexagonal 
cells  each  with  a  radius  that  is  tightly  bounded  with 
respect  to  a  given  value  R  (an  ideal  cluster  radius)  and 
zero  overlap  between  neighboring  cells.  One  node  in 
each  cell  is  distinguished,  as  the  head  of  the  cell,  to 
represent  this  cell  in  the  network.  A11  heads  in  a 
network  form  a  directed  graph,  called  head  graph,  that 
is  rooted  at  a  “big”  node,  which  is  the  interface 
between  the  wireless  network  and  external  networks 
such  as  Internet. 

Our  algorithm  yields  a  self-healing  system.  The 
head  graph  and  cellular  hexagon  structure  are  self- 
healing  in  the  presence  of  various  perturbations,  such 
as  one  or  more  node  joins,  leaves,  deaths,  movements, 
and  state  corruptions.  More  specifically,  the  self- 
healing  is  such  that  the  head  graph  and  the  cellular 
hexagon  structure  remain  stable  in  the  following 
senses:  1)  unanticipated  node  leaves  within  a  cell  are 
masked  by  the  cell;  2)  in  case  several  cells  experience 
node  deaths  at  about  the  same  time  (due  to  energy 
exhaustion),  an  independent  shift  of  each  cell  enables 
the  head  graph  as  well  as  the  cellular  hexagon  structure 
to  slide  as  a  whole  yet  maintain  consistent  relative 
location  among  cells  and  heads;  3)  in  case  the  root  of 
the  head  graph  moves  d  away  from  its  previous 
location,  only  the  part  of  the  head  graph  that  is  within 
V3  d/2  radius  from  the  root  needs  to  change 
accordingly.  Thus,  an  originally  dynamic  or  mobile 
system  is  turned  into  a  stable  infrastructure  for  other 
network  services  such  as  routing.  The  self-healing 
capability  and  the  modular  design  of  algorithm  GS3 
enable  different  modules  to  be  integrated  so  as  to  cater 
to  different  scenarios,  in  static  as  well  as  dynamic 
networks,  immobile  as  well  as  mobile  networks,  and 
networks  with  just  one  big  node  or  multiple  big  nodes. 

Our  algorithm  achieves  scalablity  in  three  respects: 
1)  local  knowledge  enables  each  node  to  maintain  the 
identities  of  only  a  constant  number  of  nearby  nodes;  2) 
local  self-healing  guarantees  that  ah  perturbations  are 
dealt  within  (and  the  impact  is  confined  to)  a  tightly 
bounded  region  around  the  perturbed  area;  the  structure 
self-stabilizes  within  the  time  to  diffuse  an  one-way 
message  across  the  perturbed  area;  3)  only  local 
coordination  is  needed  in  both  the  self-configuration 
and  self-healing  processes.  (The  complexity  and 
convergence  properties  of  our  algorithm  are 
summarized  in  Appendix  1 .) 

The  rest  of  the  paper  is  organized  as  follows.  In 
Section  2,  we  present  the  system  model  and  problem 
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statement.  We  then  develop  algorithm  for  static 
networks,  dynamic  networks,  and  dynamic  mobile 
networks  in  Section  3,  4,  and  5  respectively.  We 
discuss  related  work  in  Section  6.  Section  7  concludes 
the  paper  and  makes  further  comments  on  system 
model.  For  reasons  of  space,  we  relegate  the  discussion 
of  complexity  as  well  as  convergence  properties  of  our 
algorithm,  description  of  algorithm  modules,  and 
proofs  for  theorems  of  the  paper  to  the  Appendix. 

2.  SYSTEM  MODEL  AND  PROBLEM 
STATEMENT 

2.1  System  Model 

The  system  model  consists  of  two  parts:  models  for 
system  nodes  and  perturbations. 

System  nodes  A  system  consists  of  a  set  of  nodes  on  a 
2D  plane,  each  having  a  certain  wireless  transmission 
range. 

Node  distribution  assumption  There  exists  Rt 
(called  radius  tolerance )  such  that,  with  high 
probability,  there  are  multiple  nodes  in  each 
circular  area  of  radius  Rt  in  the  plane. 

There  are  two  kinds  of  nodes:  big  and  small. 
Intuitively,  the  big  node  acts  as  the  initiator  as  well  as 
the  access  point  for  small  nodes.  That  is,  the  big  node 
initiates  operations  (such  as  clustering)  at  small  nodes, 
and  acts  as  the  interface  between  small  nodes  and 
external  systems  such  as  Internet.  For  convenience,  we 
assume  that  the  system  has  one  big  node,  and  all  other 
nodes  are  small  (In  Section  7,  we  discuss  the  case  of 
multiple  big  nodes). 

Many  wireless  networks  have  some  central  control 
points  that  control  system  wide  operations.  E.g.,  sensor 
networks  are  used  to  sample  the  environment  for 
sensory  information  (e.g.  temperature)  and  propagate 
this  data  to  a  central  point  [6].  Also,  in  disaster 
recovery  or  battlefield  scenarios,  there  is  usually  a 
commander  for  a  group  of  rescue  workers  or  soldiers 
that  is  the  central  point. 

Wireless  transmission  assumption  Nodes  can 
adjust  transmission  range,  and  detect  location 
relative  to  other  nodes.  Destination-aware  message 
transmission  is  reliable,  but  destination-unaware 
message  transmission  (such  as  broadcast)  may  be 
unreliable. 

A  network  node  can  detect  the  strength  of  a  received 
signal,  and  calculate  the  distance  from  its 
communicating  peer  [15].  Thus  nodes  can  calculate 
relative  location  among  themselves  just  by  local 
information  exchange  in  a  dense  network,  even  without 
GPS  support.  Moreover,  when  a  node  sends  a  message 
to  some  known  node(s),  the  message  transmission  can 


always  be  made  reliable  through  mechanisms  like 
acknowledgement  and  retransmission. 

Perturbations  We  consider  two  types  of  perturbations: 
dynamic  and  mobile.  The  former  consists  of  node  joins, 
leaves,  deaths,  and  state  corruptions,  and  the  latter 
consists  of  node  movements. 

Perturbation  frequency  assumption  Node  joins, 
leaves,  and  state  corruptions  are  unanticipated  and 
thus  rare.  Node  death  is  predictable  (e.g.  as  a 
function  of  its  rate  of  energy  consumption).  The 
probability  for  a  node  to  move  distance  d  is 
proportional  to  1/d. 

For  pedagogical  reasons,  we  classify  networks  into 
three:  In  a  static  network,  there  are  neither  dynamic  nor 
mobile  nodes.  In  a  dynamic  network,  there  can  be 
dynamic  nodes,  but  no  mobile  nodes.  In  a  mobile 
dynamic  network,  both  dynamic  nodes  and  mobile 
nodes  can  exist. 

2.2  Problem  of  Self-configuration  and  Self- 
healing 

Informally,  the  self-healing  configuration  problem  is  to 
partition  a  system  such  that  the  maximum  distance 
between  nodes  within  a  partition  is  bounded,  each 
partition,  called  cell,  has  a  unique  distinguished  node, 
called  head,  and  the  heads  are  organized  into  a  head 
graph  that  is  self-healing  under  various  perturbations. 
Nodes  other  than  the  head  in  a  cell  are  called 
associates,  and  they  communicate  with  nodes  beyond 
their  cell  only  through  the  cell  head. 

We  define: 

■  Head  graph :  a  tree  that  is  rooted  at  the  big  node 
and  consists  of  all  cell  heads. 

■  Cell  radius:  the  maximum  geographic  distance 
between  the  head  of  a  cell  and  its  associates. 

Formally,  the  problem  is  to  design  an  algorithm 
that  given  R  ( ideal  cell  radius )  where  R  >  Rt, 
constructs  a  set  of  cells  and  head  graph  that  meet  the 
following  requirements: 

a)  Each  cell  is  of  radius  R  ±  c,  where  c  is  a  small 
bounded  value  with  respect  to  R,  and  is  a 
function  of  Rt. 

b)  Each  node  is  in  at  most  one  cell. 

c)  A  node  is  included  a  cell  if  and  only  if  it  is 
connected  to  the  big  node. 

d)  The  set  of  cells  and  the  head  graph  are  self- 
healing  in  the  presence  of  dynamic  as  well  as 
mobile  nodes.  By  self-healing,  a  system  can 
recover  from  a  perturbed  state  to  its  stable  state 
by  itself. 

Motivation  a)  The  primary  goal  of  geography  aware 
self-configuration  is  to  organize  nodes  into  cells  with 
certain  ideal  radius  R  that  depends  on  application 
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scenarios  (e.g.  data  aggregation  ratio  and  node 
distribution).  In  practice,  a  system  may  not  be  able  to 
organize  itself  into  cells  of  exactly  the  ideal  radius  R, 
but  the  difference  between  the  actual  radius  and  R  still 
need  to  be  small  enough,  and  is  a  function  of  Rt.  b)  By 
guaranteeing  that  each  node  belongs  to  only  one  cell, 
energy  can  be  saved,  and  the  number  of  cells  as  well  as 
control  complexity  is  reduced,  c)  If  a  node  is  able 
(unable)  to  communicate  with  the  big  node  before 
configuration,  it  should  still  be  able  (unable)  to  do  so 
after  it.  d)  In  large-scale  wireless  networks,  automation 
is  important.  Moreover,  node  crash  can  drive  a  crashing 
network  protocol  into  arbitrary  state  [17].  Thus  self- 
healing  ability  of  a  large-scale  system  is  a  must  when 
the  system  elements  are  dynamic,  mobile,  and  under 
perturbations  from  exterior  environments.  One  way  to 
achieve  it  is  by  self-stabilization. 

3.  STATIC  NETWORK 
3.1  Concepts 

Recall  that  in  static  networks,  nodes  are  neither 
dynamic  nor  mobile.  So  we  solve  our  problem  without 
considering  perturbations  (i.e.,  requirement  d)  is 
ignored).  Moreover,  we  assume  there  is  no  R,-gap  in 
static  networks,  where  an  Rt-gap  is  a  circular  area  of 
radius  Rt  with  no  node  inside.  R,-gaps  are  dealt  with  as 
a  kind  of  rare  perturbation  in  dynamic  networks 
discussed  in  Section  4. 

Let  us  first  consider  an  ideal  case  of  the  problem: 
given  a  plane  with  a  continuous  distribution  of  nodes, 
we  may  divide  it  into  cells  of  equal  radius  R  with 
minimum  overlap  between  neighboring  cells  to  obtain  a 
cellular  hexagon  structure  as  shown  in  Figure  1 .  In  this 
structure,  each  cell  is  a  hexagon  with  the  maximum 
distance  between  its  geometric  center  and  any  point  in 
it  being  R.  Let  the  geometric  center  of  a  cell  be  the 
“head”  of  ah  points  in  the  cell.  Then  the  distance 
between  the  heads  of  any  two  neighboring  cells  is  -J3R  ■ 
And  each  cell  that  is  not  on  the  boundary  of  the  plane  is 
surrounded  by  6  neighboring  cells. 

•  4—/  • 

r  /  Sr 

IL,  \  \  ‘ 
m2 

Figure  1 :  Cellular  hexagon  structure 

Of  course,  in  reality,  node  distribution  is  not 
continuous,  thus  there  may  be  no  node  at  the  geometric 
center  of  some  cell  and  it  may  be  impossible  to  divide 
the  network  into  exact  hexagons  as  in  Figure  1.  But  in 
scenarios  where  there  are  multiple  nodes  in  any  circular 
area  of  radius  Rt,  we  can  still  approximate  this  structure 
by  letting  some  node  within  Rt  distance  from  the 


geometric  center  of  a  cell  be  a  head,  as  is  allowed  in 
traditional  cellular  networks  [10]. 

Our  solution  is  achieved  in  three  steps.  First,  we 
cover  a  system  with  a  hexagonal  virtual  structure  as  in 
Figure  1  such  that  the  big  node  is  located  at  the 
geometric  center  of  some  cell.  Second,  for  each  cell  C 
in  the  virtual  structure,  we  choose  a  node  k  closest  to 
the  geometric  center  pc  of  C  as  a  head,  and  p,  is  called 
the  Ideal  Location  of  k,  IL(k);  Third,  for  every  non- 
head  small  node  j  covered  by  a  cell  C,  we  let  j  be  an 
associate  and  chooses  the  best  (e.g.  the  closest  in  a 
clockwise  sense)  head  as  its  head,  H(j);  Thus,  a  head 
together  with  its  associates  form  a  cell,  and  the  IL  of 
the  head  is  also  called  the  IL  of  the  cell. 

We  designate  the  cell  where  the  big  node  is  as  the 
central  cell,  and  each  set  of  cells  of  equal  minimum 
distance  from  the  central  cell  in  terms  of  the  number  of 
cells  in  between  as  a  cell  band.  If  cells  in  a  band  are  of 
(7-cell  distance  from  the  central  cell,  this  band  is  called 
a  d-band,  and  the  central  cell  alone  forms  the  0-band. 

Next,  we  discuss  a  scalable  distributed  algorithm 
that  implements  the  above  concepts. 

3.2  Algorithm 

Overview  The  self-configuration  algorithm  consists  of 
a  one-way  diffusing  computation  across  the  network. 
The  big  node  H0  initiates  the  computation  by  acting  as 
the  head  for  the  0-band  cell  (i.e.  the  cell  whose  IL  is  at 
H0),  and  selecting  the  heads  of  its  neighboring  cells  in 
its  search  region.  Then  each  newly  selected  head 
selects  the  heads  of  its  neighboring  cells  in  its  search 
region,  and  so  on  until  no  new  head  is  selected.  Every 
node  that  has  participated  in  the  computation  but  not 
been  selected  as  head  becomes  an  associate  and 
chooses  the  best  head  in  the  system  as  its  head. 

If  head  i  is  elected  by  head  j,  we  say  that  j  is  the 
parent  of  /,  P(i),  and  i  is  a  child  of  j,  CH(j).  P(H0)  is  H0. 
Then  the  search  region  of  a  head  i  is  defined  as  the  area 
within  (^3  R+2R,j  distance  from  i  that  is  between  the 
two  directions:  L  direction  (LD)  and  R  direction  (RD) 
with  respect  to  direction  iL(P(i)),IL(i)  (see  Figure  3).  In 
order  to  guarantee  that  every  node  connected  to  H0  is 
covered  by  the  diffusing  computation,  <LD,  RD>  is 
chosen  as  <0°,  360°>  and  <-60°-a,  60°+a>  for  H0  and 
the  other  heads  respectively,  where  a  =  Sin  ’(Rt/V3  R). 

In  most  cases,  a  (V/+7)-band  cell  head  is  selected  by 
a  (7-band  head  (d  >  0).  But  in  the  case  where  the  speed 
of  the  diffusing  computation  differs  at  different 
directions  with  respect  to  H0,  it  is  also  possible  that  a 
f(7+7)-band  head  is  selected  by  a  f(7+2)-band  head  (d  > 
1).  But  this  does  not  affect  the  correctness  of  GS3-S, 
and  it  is  dealt  implicitly  in  algorithm  in  Section  4.  For 
simplicity,  we  do  not  discuss  this  case  any  further. 
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Algorithm  modules  The  algorithm  (GS3-S)  consists 
of  two  programs  (described  in  Figure  2):  Big_node  at 
H0  and  SmciUjiode  at  all  the  small  nodes.  Underlying 
these  two  programs  are  modules  used  for  head 
organization:  HEAD_ORG,  used  to  organize  heads,  and 
HEAD_ORG_  RESP  as  well  as  ASSOCIATE_ORG_RESP, 
used  to  respond  to  a  HEAD_ORG. 

In  HEAD_ORG,  a  head  i  (including  H0)  organizes 
neighboring  heads  in  its  search  region.  It  first  gets  the 
state  (e.g.  geographic  location)  of  all  the  nodes  in  its 
search  region  by  local  information  exchange;  then  it 
selects  the  neighboring  heads  using  the  low-level 
module  HEAD_SELECT;  last,  it  broadcasts  the  selected 
set  of  heads  to  nodes  within  ( p  R+2R,j  distance.  In 
HEAD_SELECT  (described  in  Figure  3),  head  i  first 
calculates  the  /Ls  for  the  neighboring  cells  in  its  search 
region;  then  for  each  IL  j  that  is  not  the  IL  of  an 
existing  head,  i  selects  the  best  node  less  than  Rt  away 
from  j  as  a  head. 

In  HEAD_ORG_RESP,  a  head  sends  its  state  in 
response  to  a  HEAD_ORG  at  another  head  at  most 
(V3R+2Rt)  away.  In  ASSOCIATE_ORG_RESP,  which  is 
executed  by  a  small  node  i  in  response  to  a  HEAD_ORG 
at  a  head  j  at  most  ( ^3  R+2Rt)  away,  if  i  already  has  a 
head,  i  sets  j  as  its  head  only  if  j  is  better  than  its 
current  head;  if  i  does  not  have  a  head,  it  sends  its  state 
to  j,  and  waits  for  j’s  decision  of  whether  i  is  selected 
as  a  head,  and  sets  its  status  accordingly. 

(A  more  detailed  description  of  these  modules  is  given 
in  Appendix  2) 

3.3  Analysis 

In  this  subsection,  we  discuss  the  invariant,  fixpoint, 
self-stabilization,  and  other  properties  of  algorithm 
GS3-S  (proofs  are  given  in  Appendix  4). 

Notation 

Physical  network  Gp  =  (Vp,  Ep),  where  Vp  =  {  j:  j  is  a  node  in  the 
system)  and  Ep  =  {(i,  j):  i  e  Vp  a  j  e  Vp  a  (i  and  j  are  within 
transmission  range  of  each  other)}. 

Head  Graph  Gh  =  (Vh,  Eh),  where  Vh={ i:  ie  Vp  a  i  is  a  cell  head} 
and  Eh  ={(i,  j):  i  e  Vh,  j  e  CH(i)}. 

Head  level  structure:  the  set  of  heads  in  a  system  and  the 
geographic  relation  (distance,  relative  direction)  among  them. 
Geographic  coverage :  the  geographic  coverage  of  a  node  is  the 
circular  area  on  a  plane  that  is  centered  at  the  node  and  has  a 
radius  equal  to  the  current  transmission  range  of  the  node.  The 
geographic  coverage  of  a  system  is  the  union  of  the  geographic 
coverage  of  all  the  nodes  in  a  system. 

Boundary  cell :  a  cell  that  is  on  the  boundary  of  the  geographic 
coverage  of  a  system. 

Inner  cell',  a  cell  that  is  not  a  boundary  cell. 

Neighboring _heads(i):  {  j:  j  is  a  head  a  (head  i  and  j’s  geographic 
coverage  adjoins}. 

Visible  node:  a  node  that  is  connected  to  H0  in  Vp. 

Distfi,  j):  cartesian  distance  between  nodes  i  and  j. 


Program  Bigjiode 

varq:  {bootup,  work};  //node  status 
/*  Big  node  boots  up  and  organizes  the  1  -band  cells  */ 
q  =  bootup  — >  HEAD_ORG(0°,  360°,  R.  R/4)  //transit  to  status  work 
Program  Small_node 

varq:  {bootup,  head,  work,  associate};  //node  status 

/*  Small  nodes  boot  up,  listen  to  nearby  HEAD_ORG  *1 

q  =  bootup  — >  ASSOCIATE_ORG_RESP  //transit  to  status  head  or 

associate 

[] 

/*  Heads  organize  neighboring  heads  in  their  search  regions  */ 
q  =  head  — >  HEAD_ORG(-60°-0t,  +60°+OC,  R,  R/4)  //transit  to  status 

work:  OC  =  Sin_1(Rt/  ^/3  R) 

[] 

q  =  work  — >  HEAD_ORG_RESP 

[] 

/*  Associates  respond  to  HEAD_ORG  */ 

q  =  associate  — >  ASSOCIATE_ORG_RESP  //remain  status  associate 

Figure  2:  Self-configuration  algorithm  for  static  networks  (GS3-S) 


Module  HEAD_SELECT  (SmallNodes,  ExistingHeads,  LD,  RD,  R,  Rt) 

Step  1 :  Calculate  /Ls  of  neighboring  heads,  NH,  in  the  search  region  of  i. 
Use  iL(P(i))JL(i)  as  reference  direction  (RD)  (if  P(i)  =i,  RD  can  be 

any  direction),  IL(i)  as  origin,  and  R  as  radius,  go  both  clockwise  and 
counterclockwise,  the  points  on  the  arc  that  are  jx60°  (  |_LD/60j  <j  < 
|_RD/60_|)  degree  from  RD  are  the  ILs  of  neighboring  heads. 


IL(i) 


LD  7Rt 


'A  v3A’-2R 

m  r^ 


RD 


v  FID 

arch  region 


Step  2:  Remove  the  set  of  IL  that  is  the  IL  of  some  existing  head  from 
NH.  Le.  NH  <—  (NH  -  EH),  where  EH  =  {j  :  j  e  NH  a  (3  k  e 
ExistingHeads  :  (  dist(j,  k)  <  Rt ))}. 

Step  3:  For  each  IL  j  in  NH,  let  CA(j)  =  {k  :  k  e  SmallNodes  a  dist(k,  j) 
<  Rt}.  CA(j)  is  the  set  of  small  nodes  within  Rt  distance  from  ILj. 

Step  4:  For  each  ILj  in  NH,  since  CA(j)  is  non-empty,  select  the  highest 
ranked  node  j’  in  CA(j)  as  the  cell  head  corresponding  to  ILj,  and 
set  CH(i)  as  (  CH(i)  u  {j’J  ). 

Every  node  k  in  CA(j)  is  lexicographically  ordered  by  <d,  \A\, 
A>,  where  d  is  the  distance  between  j  and  k,  A  stands  for  the  angle 
(-180°  <  A  <  180°)  formed  by  qr  and  (A  is  negative  if 
goes  clockwise  with  respect  to  gr  and  positive  if  counter¬ 
clockwise),  and  d  has  the  highest  significance. 


□ 

Time  complexity :  0  ( ISmallNodesI ) 


Figure  3:  HEAD_SELECT  module  used  in  HEAD_ORG 


3.3.1  Invariant 

We  show  the  correctness  of  algorithm  GS3-S  using 
an  invariant,  i.e.  a  state  predicate  that  is  always  true  in 
every  system  computation.  Note  that  an  invariant 
depends  on  the  granularity  of  actions.  Here  we  consider 
every  algorithm  module  (e.g.  HEAD_ORG)  as  an  atomic 
action.  Our  invariant  SI  =  I|  a  I2  a  I3,  where  Ij  (j  =  1,  2, 
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3)  is  individually  closed  under  algorithm  actions.  The 
predicates  are  as  follows. 

11  (Connectivity)  =  Iu  a  IL2,  where 

■  Iu :  Every  pair  of  heads  that  is  connected  in  Gh  is 
connected  in  Gp,  and  vice  versa. 

(V  i,  j  g  Vhi  there  is  a  path  between  i  and  j  in  Gh  <=>  there  is  a  path 
between  i  and  j  in  Gp) 

■  1 1,2-  Gh  is  a  tree  rooted  at  the  big  node  H0. 

((P(H0)  =  Ho)  A  (hops(Ho)  =  0))  A 
(V  i  G  (Vh-  {H0}):  hops(H0,  i)  =  hops(H0,  P(i))+1)  A 
(V  i,  j  g  Vh:  i  and  j  are  connected  in  Gh)  a 
(V  i,  jG  Vhi  there  is  a  path  of  length  >  2  between  i  and  j  => 
(P(i)*jAP(j)*i) 

where  hops(i,  j)  is  the  path  length  between  i  to  j  in  Gh. 

12  (Hexagonal  Structure)  =  I2I  a  I2  2  a  1 2.3  a  I24,  where 

■  hj.  Each  inner  cell  head  has  exactly  6  neighboring 
heads  that  form  a  cellular  hexagon  centered  at  head  i 
and  of  edge  length  V3R,  with  vertices'  location 
deviation  at  most  Rt. 

(V  inner  cell  head  i:  ( I  neighboring_heads(i)  I  =  6) 

A(Vje  neighboring_heads(i):  ^3  R-2R,  <  dist(i,  j)  <  R+2R, )) 

■  I22:  Each  boundary  cell  head  has  less  than  6 
neighboring  heads,  and  the  distance  among  them  is 
bounded  by  [  V3  R-2Rt,  R-2Rt], 

(V  boundary  cell  head  i:  I  neighboring_heads(i)  I  <  6) 
a  (VjG  neighboring_heads(i):  ^3  R-2Rt  <  dist(i,  j)  < ^3  R+2Rt) ) 

■  I23:  Each  head,  except  for  H0,  has  at  most  3  children 
heads.  H0  has  6  children  heads  if  it  is  an  inner  cell 
head  and  at  most  5  children  heads  otherwise. 

(  V  head  i  *  H0:  I  CH(i)  I  <  3  )  a 

(Ho  is  an  inner  cell  head  =>  ( I  CH(Ho)  I  =  6  ))  a 

(Ho  is  a  boundary  cell  head  =>  ( I  CH(Ho)  I  <  5  ) ) 

■  1 2.4-  Each  cell  is  of  radius  (R-t-Rrandom),  where  IRrandoml 
is  at  most  (2R/V3).  Each  associate  is  of  (R+Rrandom) 
distance  to  its  head. 

(V  inner  cell  C:  Vassociate  i  e  C:  R-(2Rt/  ft,  )  <  dist(i,H(i))  <  R+(2Rt/  ft,  )) 

13  (Inner  Cell  Optimality):  Each  associate  in  an  inner  cell 
belongs  to  only  one  cell  and  chooses  the  best  (e.g. 
closest)  head  as  its  head. 

(V  associate  i  in  an  inner  cell:  Vhead  j  V  H(i)=>H(i)  better  than  i  ) 

Theorem  7:  SI  is  an  invariant  of  algorithm  GS3-S. 
Theorem  1  and  I2  imply 

Corollary  1 :  The  distance  among  neighboring  cell 
heads  is  bounded  by  [ y3  R-2R„  R-2RJ . 

(Vhead  i:  (VjG  neighboring_heads(i):  R-2  Rt  <  dist(i,  j )  <  R+2  Rt ) 

Corollary  2:  The  heads  and  their  cells  form  a  cellular 
hexagonal  structure  (shown  in  Figure  4)  with  bounded 
head  location  deviation  Rt. 

3.3.2  Fixpoint 

A  fixpoint  is  a  set  of  system  states  where  either  no 
action  is  enabled  or  any  enabled  action  does  not  change 
any  system  state  we  are  interested  in  (e.g.  Gh).  It 
therefore  characterizes  the  result  of  the  self¬ 
configuration  process.  Our  fixpoint  SF  =  F!  a  F2  a  F3  a 
F4  as  follows. 


Figure  4:  Self-configured  cellular  hexagon  structure 

Ft  (Connectivity)  and  F2  (Hexagonal  Structure)  are  the 
same  as  C  and  I2  respectively. 

F3  (Cell  Optimality):  Each  associate  belongs  to  only  one 
cell  and  chooses  the  best  head  as  its  head. 

(V  associate  i :  V  head  j  ^  H(i)  =>  H(i)  better  than  j ) 

F4  (Coverage):  The  set  of  heads  and  cells  covers  all  the 
visible  nodes  in  a  system. 

(V  visible  node  i  :  3  head  j :  j  =  H(i) ) 

Theorem  2:  SF  is  a  fixpoint  of  algorithm  GS3-S. 

Requirement  a)  and  h)  are  satisfied  by  Theorem  1 
and  2. 

Theorem  2,  Fi  and  F4  imply 

Corollary  3\  At  SF,  a  node  is  in  a  cell  if  and  only  if  it  is 
connected  to  the  big  node  in  Gp,  and  vice  versa. 

(V  node  i :  H(i)  i=-  NULL  <=>  there  is  a  path  between  i  and  Ho  in  Gp) 

Requirement  c)  is  satisfied  by  Corollary  3. 

3.3.3  Self-stabilization 

Theorem  3:  Starting  from  any  state,  every  computation 
of  GS3-S  reaches  a  state  where  SI  holds  within  a 
constant  amount  of  time. 

Theorem  4\  Starting  from  any  state  where  SI  holds, 
every  computation  of  GS3-S  reaches  a  state  where  SF 
holds  within  time  0(Db),  where  Db  =  max{dist(H0,  i):  i 
is  a  small  node,  and  dist(H0,i)  is  the  cartesian  distance 
between  H0  and  i } . 

Theorem  3  and  4  imply 

Corollary  4\  Starting  from  any  state,  every  computation 
of  GS3-S  reaches  a  state  where  SF  holds  within  time 
6(Db). 

Termination  of  the  diffusing  computation  follows 
from  Corollary  4. 

3.3.4  Scalability 

The  self-configuration  algorithm  GS3-S  is  scalable  in 
that  it  only  requires  local  coordination  among  nodes 
within  ( ^3  R+2Rt)  distance  from  one  another,  and  each 
node  maintains  the  identities  (e.g.  MAC  address)  of 
only  a  constant  number  of  nodes,  1  for  associates  and 
at  most  6  for  heads,  irrespective  of  network  size. 

4.  DYNAMIC  NETWORK 
4.1  Concepts 

Recall  that  in  dynamic  networks,  nodes  can  join,  leave 
(e.g.  failure),  die,  and  node  state  can  be  corrupted. 
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Excluding  node  death,  which  is  predictable,  the  other 
perturbations  are  unanticipated  and  therefore  rare. 
There  may  also  be  Rt-gaps  in  node  distribution.  In  this 
section,  we  extend  GS3-S  to  GS  -D  to  deal  with  these 
perturbations. 

We  propose  three  mechanisms  to  deal  with  node 
leave  and  death:  head  shift,  cell  shift,  and  cell 
abandonment.  Self-stabilization  easily  handles  the 
remaining  perturbations,  i.e.  node  joins  and  state 
corruptions. 

Head  shift  In  dynamic  networks,  the  associates  in  a 
cell  are  divided  into  two  categories:  candidate  and  non¬ 
candidate.  Associates  within  Rt  distance  from  the  IL  of 
the  cell  are  head  candidates,  with  the  rest  being  non¬ 
candidates.  In  the  case  where  only  unanticipated  head 
leaves  occur,  a  new  head  can  be  found  with  high 
probability  from  the  set  of  candidates,  due  to  the  low 
probability  of  all  candidates  in  a  cell  leaving  at  the 
same  time.  Moreover,  the  extreme  case  where  all 
candidates  leave  can  still  be  dealt  with  using  cell  shift. 

Cell  shift  In  case  node  death  occurs,  it  is  possible 
that  the  set  of  candidates  of  a  cell  becomes  empty  due 
to  energy  exhaustion  after  long  enough  system 
operation.  In  this  case,  the  IL  of  the  cell  is  changed  to 
another  point  IL'  within  the  geographic  coverage  of  the 
cell  such  that  the  corresponding  candidate  set  is  non¬ 
empty,  since  energy  usually  exhausts  faster  at  a  head 
than  at  an  associate.  In  many  envisioned  large-scale 
wireless  networks,  the  traffic  load  across  a  network  is 
statistically  uniform  due  to  in-network  processing  such 
as  data  aggregation  [16],  which  means  statistically 
uniform  energy  dissipation  across  the  network.  Given 
the  fact  that  statistically  there  are  multiple  nodes  in  any 
Rt-radius  circular  area  at  the  beginning  of  the  self¬ 
configuration,  the  lifetime  of  any  two  sets  of  candidates 
at  different  cells  is  statistically  the  same  with  low 
deviation,  especially  for  cells  close  by.  Therefore,  if  the 
ILs  at  different  cells  change  (the  relative  position 
between  IL  and  IL')  independently  but  in  the  same 
deterministic  manner,  the  head  graph  as  well  as  head 
level  structure  will  slide  as  a  whole  but  maintain 
consistent  relative  location  among  cells  and  heads. 

Cell  abandonment  It  is  possible  albeit  rarely  that  a 
cell  is  so  heavily  perturbed  that  nodes  in  a  larger  than 
Rt-radius  area  die  at  the  same  time.  Even  though  cell 
shift  may  be  able  to  change  the  IL  of  the  cell  to  IL',  the 
distance  between  IL'  and  the  ILs  of  all  neighboring 
cells  may  deviate  beyond  fsR.  In  this  case,  we  let  the 
cell  to  be  abandoned  in  the  sense  that  every  node  in  it 
becomes  an  associate  of  one  of  the  neighboring  cells. 
(Note  that,  because  of  the  sliding  of  the  head  level 


structure  resulted  from  cell  shift,  a  new  head  can  be 
selected  within  an  abandoned  cell  later.) 

4.2  Algorithm 

Overview  In  GS  -D,  when  a  head  i  tries  to  select  the 
heads  for  its  neighboring  cells  in  its  search  region,  it  is 
possible  that  there  is  an  Rt-gap  at  the  IL  of  a 
neighboring  cell  C.  Given  the  low  probability  of  this 
case,  i  does  not  select  head  for  cell  C,  and  every  node 
in  C  becomes  an  associate  of  a  neighboring  cell  of  C 
(this  is  similar  to  cell  abandonment).  However,  due  to 
node  join  and  the  sliding  of  head  level  structure,  new 
nodes  may  show  up  in  the  area  of  C  or  the  IL  for  C  is 
changed  such  that  there  is  a  node  within  Rt  distance  to 
the  IL  of  C  later.  By  periodically  checking  this  case, 
head  i  will  select  the  head  for  C  whenever  it  shows  up 
later. 

When  a  node  j  joins  an  existing  system,  it  tries  to 
find  the  best  existing  head  as  its  head  if  there  is  any 
within  (V3R+2Rt)  distance.  Otherwise,  j  tries  to  find 
the  best  associate  as  its  surrogate  head  if  there  is  any 
associate  within  its  radio  transmission  range.  If  both 
trials  fail,  j  gives  up  and  retries  the  above  process  after 
a  certain  amount  of  time.  In  the  above  process,  if  a 
head  k  within  ( fi  R+2Rt)  distance  is  executing 
HEAD_ORG,  j  responds  with  ASSOCIATE_ORG_RESP 
and  becomes  either  a  child  head  or  an  associate  of  k. 

Node  leave  or  death  is  dealt  with  by  intra-cell  and 
inter-cell  maintenance.  In  intra-cell  maintenance,  head 
shift  enables  the  highest  ranked  candidate  to  become 
the  new  head  of  a  cell  when  the  head  of  the  cell  fails  or 
proactively  becomes  an  associate  when  it  is  resource 
scarce  or  a  candidate  better  serves  as  head;  when  the 
candidate  set  is  weak  (e.g.  empty),  cell  shift  enables  the 
cell  head  to  strengthen  the  candidate  set  by  selecting  a 
better  IL  for  this  cell  if  any  such  IL  exists  (described  in 
figure  5);  cell  abandonment  enables  nodes  within  a 
heavily  perturbed  cell  to  become  an  associate  in  one  of 
its  neighboring  cells.  In  inter-cell  maintenance,  a 
parent  head  and  its  children  heads  monitor  one  another. 
If  a  head  h  leaves  and  the  intra-cell  maintenance  in  its 
cell  fails,  the  parent  of  h,  P(h),  tries  to  recover  it  first.  If 
P( h )  fails  too,  each  child  of  h  tries  to  find  a  new  parent 
by  themselves;  also,  a  head  chooses  the  neighboring 
head  closest  to  H0  as  its  parent;  an  optional  action  is  for 
a  cell  to  synchronize  its  IL  with  that  of  its  neighboring 
cells,  which  affects  the  tightness  of  cell  radius  with 
respect  to  R  locally  within  its  one-hop  neighborhood. 

Node  state  corruption  is  dealt  with  by  “sanity 
checking”.  Periodically  (with  low  frequency)  each  head 
h  checks  the  hexagonal  relation  with  its  neighboring 
heads,  according  to  the  system  invariant.  If  the 
invariant  is  violated,  h  asks  its  neighboring  heads  to 
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check  their  state.  If  all  its  neighboring  heads  are  valid, 
the  state  of  h  must  be  corrupted,  and  h  becomes  an 
associate;  if  some  of  its  neighboring  heads  are  invalid, 
h  cannot  decide  whether  it  is  valid  at  this  moment,  and 
will  check  this  next  time. 

Algorithm  modules  Compared  with  GS  -S,  GS  -D, 
as  described  in  Figure  6,  has  modified  head 
organization  modules,  new  modules  for  node  join, 
intra-cell  maintenance,  inter-cell  maintenance,  and 
sanity  checking  (detailed  description  of  these  modules 
is  in  given  Appendix  2). 

Modified  head  organization  modules  are  as 
follows.  In  HEAD_ORG,  executed  by  a  head  i,  i 
maintains  not  only  its  children  heads  set,  but  also  its 
neighboring  heads  set  and  candidates  set.  In 
HEAD_SELECT  executed  by  a  head  i,  i  does  not  select 
head  a  cell  in  its  search  region  if  there  is  an  Rt-gap  at 
the  IL  of  the  cell.  In  HEAD_ORG_RESP,  executed  by  a 
head  /  in  response  to  the  HEAD_  ORG  at  a  head  j,  i  sets 
j  as  its  parent  if  j  is  better  (e.g.  closer  to  the  big  node) 
than  its  current  parent. 

Node  join  consists  of  three  modules: 
SMALL_NODE_BOOT_UP  used  by  a  bootup  node 
trying  to  find  a  nearby  head  or  associate; 
HEAD_JOIN_RESP  and  ASSOCIATE_JOIN_RESP  used 
by  a  head  or  an  associate  respectively  in  response  to  the 
SMALL_NODE_BOOT_UP  at  a  nearby  “bootup”  node, 
where  it  sends  its  state  to  the  bootup  node  and  listens  to 
its  decision  to  join  or  not. 

Intra-cell  maintenance  consists  of  four  modules: 
HEAD_INTRA_CELL,  CANDID  ATE_INTRA_CELL, 

ASSOCIATE_INTRA_CELL,  and  BIG_SLIDE. 

In  HEAD_INTRA_CELL,  executed  by  a  head  it 
exchanges  heartbeats  with  associates  in  its  cell.  Head  i 
becomes  an  associate  when  it  is  resource  scarce,  a 
candidate  serves  better  as  head,  or  the  big  node  is  in  its 
cell  and  resumes  its  role  as  head.  When  the  candidate 
set  is  weak,  i  strengthens  it  using  the  low-level  module 
STRENGTHEN_CELL  that  implements  the  concept  of 
cell  shift  (description  of  STRENGTHEN_  CELL  is 
given  in  Appendix  2).  If  its  cell  is  heavily  perturbed 
such  that  the  hexagonal  property  within  its 
neighborhood  has  deviated  too  much,  i  abandons  its 
cell  and  transits  to  status  bootup. 

In  CANDID  ATE_INTRA_CELL,  executed  by  a 
candidate  i,  i  exchanges  heartbeats  with  its  head.  When 
its  head  fails  or  becomes  an  associate,  i  coordinates 
with  other  candidates  in  its  cell  to  elect  a  new  head. 
When  its  head  transits  to  status  bootup,  i  transits  to 
status  bootup  too.  When  a  head  j  that  is  better  than  its 
current  head  shows  up,  i  sets  j  as  its  new  head. 
ASSOCIATE_INTRA_CELL  executed  by  a  non¬ 
candidate  i  is  almost  the  same  as  CANDIDATE_INTRA_ 


We  call  a  cell  C  formed  in  the  initial  phase  of  self-configuration  an 
original  cell,  and  the  IL  of  C  an  original  ideal  location  (OIL).  To 
maximize  the  lifetime  of  the  hexagonal  structure,  for  any  original  cell  C, 
the  union  of  its  candidate  sets  of  all  the  ILs  should  cover  all  nodes  in  C. 
Let  CA(/Lr)  be  the  Rt-radius  circular  area  centered  at  an  ideal  location 
/Lk.  Then  a  cell  can  be  divided  into  a  set  of  such  CAs  as  shown  in  the 
following  figure,  which  is  self-similar  to  a  system  being  divided  into  a 
set  of  cells: 


Analogous  to  “bands”,  we  call  each  set  of  CAs  of  equal  minimum 
distance  to  its  OIL  (in  terms  of  CAs  in  between)  an  Intra  Cell  Cycle 
(ICC).  The  set  of  CAs  on  the  same  ICC  is  numbered,  called  Intra  Cycle 
Postion  (ICP),  in  an  increasing  order  clockwise  with  respect  to  GR  (f°r  a 
certain  ICC,  the  range  for  ICP  is  [0,  6xICP-l]).  Then  the  ILs  in  a  cell  can 
be  lexicographically  ordered  by  tuple  <ICC,  ICP>,  and  are  considered  for 
becoming  the  current  IL  of  a  cell  in  an  increasing  order. 

Figure  5:  Method  to  change  the  IL  of  a  cell 


Program  Big_node 

GS3-S  with  modified  HEAD_ORG 
[] 

/*  Deal  with  node  join  */ 

q  =  work  — >  HEADJ O INGRES  P  //remain  status  work 
[] 

/*  Deal  with  node  leave:  remain  status  work  or  transit  to  status  big_slide  */ 
q  =  work->  [HEAD_INTRA_CELLIHEAD_INTER_CELL] 

[] 

/*  The  big  node  does  not  act  as  head  */ 

q  =  big_slide  — >  BIG_SLIDE  //remain  status  big_slide,  or  transit  to  status 
work 


Program  Small_node 

GS3-S  with  modified  HEAD_ORG  &  HEAD_ORG_RESP 
[] 

q  =  bootup  — >  SMALL_NODE_BOOT_UP  //remain  status  bootup,  or 
transit  to  status  associate  or  surrogate  associate 

[] 

I*  Head  node  */ 

/*  Deal  with  node  join  */ 

q  =  work  — >  HEAD_JOIN_RESP  //remain  status  work 

[] 

/"Deal  with  node  leave:  remain  status  work,  or  transit  to  status  associate */ 
q  =  work  ->  [HEAD_INTRA_CELLIHEAD_INTER_CELL] 

[] 

/*  Sanity  checking:  remain  status  work,  or  transit  to  status  associate  */ 
q  =  work  »  ,  SANITY_CHECK 
[] 

/*  Associate  node  */ 


/*  Deal  with  node  join:  remain  status  associate/candidate  */ 

(q  =  associate  v  q  =  candidate)  — >  ASSOCIATE_JOIN_RESP 
[] 

/*  Deal  with  node  leave:  remain  status  candidate/associate,  or  transit  to 
status  head  or  bootup  *1 

q  -  candidate  — >  CANDIDATE_INTRA_CELL 
[] 

q  =  associate  — »  ASSOCIATE_INTRA_CELL 


Figure  6:  Self-configuration  algorithm  for  dynamic  networks  (GS3-D) 


CELL  except  that  i  transits  to  status  bootup  when  its 
head  fails. 

In  BIG_SLIDE  executed  by  the  big  node  H0,  H0 
keeps  the  head  in  the  coverage  of  its  original  cell  as 
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head,  and  resumes  head  role  when  the  OIL  of  its  cell 
becomes  the  current  IL. 

Inter-cell  maintenance  is  implemented  by  the 
module  HEAD_INTER_CELL.  In  HEAD_INTER_CELL, 
executed  by  a  head  i,  i  exchanges  heartbeats  with  its 
neighboring  cell  heads.  If  a  neighboring  head  j  is  closer 
to  H0  than  its  current  parent,  i  sets  j  as  its  new  parent.  If 
a  child  j  fails  and  the  intra-cell  maintenance  at  its  cell 
fails  too,  i  tries  to  deal  with  it  using  HEAD_ORG  in  the 
direction  of  j.  If  the  parent  of  i,  P(i),  fails,  and  the 
failure  is  not  recovered  by  the  intra-cell  maintenance  at 
P(i)’s  cell  or  by  P(i)’s  parent,  i  tries  to  find  a  new 
parent  using  low-level  module  PARENT_SEEK.  If  i  is  a 
boundary  cell  head,  it  periodically  checks  whether  new 
nodes  show  up  in  the  direction  where  it  does  not  have  a 
child,  using  HEAD_ORG  in  that  direction.  When  a 
neighboring  head,  a  child,  or  its  parent  changes  its  IL,  i 
optionally  synchronizes  its  IL  using  low-level  module 
SYN_CELL  (the  description  of  PARENT_SEEK  and 
SYN_CELL  is  given  in  Appendix  2). 

Sanity  checking  is  implemented  by  the  module 
SANITY_CHECK  whose  time  complexity  is  Q(DC), 
where  Dc  is  the  diameter  of  a  contiguous  state- 
corrupted  area. 

4.3  Analysis 

New  notation 

Head  Neighboring  Graph  Gh„  =  (Vhn  ■  Ehn),  where  Vhn  =  Vh  of  Gh, 
and  Ehn  =  {(i,  j):  i  and  j  are  neighboring  heads}. 

4.3.1  Invariant 

The  invariant  of  GS3-D  is  the  same  as  that  of  GS3-S 
except  for  the  following  three  points  (formal 
descriptions  are  given  in  Appendix  3): 

■  In  I2.i  and  I2.2,  if  the  <ICC,  ICP>  value  (see  figure  5) 
of  a  head  i  is  different  from  that  of  a  neighboring 
head  j,  the  distance  between  them  is  bounded  by  \d 
-2Rt,  d  +2RJ,  where  d  is  the  distance  between  IL(i) 
and  IL(j)  and  is  bounded  by  (0,  2  ^3  R). 

■  In  I2  3,  the  number  of  children  heads  of  a  head  other 
than  the  big  node  is  at  most  5  (instead  of  3). 

■  In  I24,  the  radius  of  an  inner  cell  is  bounded  by  (0, 
2R+RJ  if  its  <ICC,  ICP>  value  is  different  from  that 
of  any  of  its  neighboring  cell;  and  IRrand0ml  is  at 
most  (( fs  -l)R+2Rt+dp)  for  boundary  cells,  with  dp 
being  the  diameter  of  the  gap-perturbed  area 
adjoining  the  boundary  cell  (dp  is  0  if  there  is  no 
gap-perturbed  area). 

Theorem  5:  DI  is  an  invariant  of  algorithm  GS-D, 
where  DI  =  SI  (invariant  of  GS3-S)  with  I2  relaxed  as 
above. 

4.3.2  Fixpoint 

The  fixpoint  of  GS3-D  is  the  same  as  that  of  GS3-S 
except  for  the  following  two  points: 


■  Fi.2  is  strengthened  as:  Gh  is  a  minimum-distance 
(with  respect  to  the  big  node  H0)  spanning  tree  of 
Ghn  rooted  at  H0,  i.e.  the  path  between  H0  and  a 
head  i  in  Gh  is  a  minimum  distance  path  between 
H0  and  i  in  Ghn. 

■  F2 4  is  relaxed  as:  (F24  of  GS3-S)  a  (IRrandoml  is  at 
most  (2R/V3  +  dp)  for  boundary  cells). 

Theorem  6:  DF  is  a  fixpoint  of  algorithm  GS-D,  where 
DF  =  SF  (fixpoint  of  GS3-S)  with  Fi.2  and  F2  4  updated 
as  above. 

Fi,  F2,  F3,  and  F4  imply 

Corollary  5:  At  DF,  Corollary  1,  2,  and  3  hold  in 
dynamic  networks. 

4.3.3  Self-stabilization 

Theorem  7:  Starting  from  any  state,  every  computation 
of  GS3-D  reaches  a  state  where  DI  holds  within  time 
0(DC),  where  Dc  is  the  diameter  of  a  continuous  state- 
corrupted  area. 

Theorem  8:  Starting  from  any  state  where  DI  holds, 
every  computation  of  GS-D  reaches  a  state  where  DF 
holds  within  time  0(max{(Dd/c/),  Td}),  where  c2  is  the 
average  speed  of  message  diffusing  and  Td  is  the 
maximum  difference  between  the  lifetime  of  the 
candidate  set  of  two  neighboring  cells. 

Theorem  7  and  8  imply 

Corollary  6:  Starting  from  any  state,  every  computation 
of  GS3-D  reaches  a  state  where  DF  holds  within  time 
0(max{(Dd/c;),  Td}). 

Requirement  d)  is  satisfied  by  Theorem  7  and  8. 

4.3.4  Remarks 

■  Scalable  self-healing 

The  self-healing  of  the  head  graph  and  hexagonal 
structure  is  scalable  in  three  senses:  first,  local  self- 
healing  enables  the  system  to  stabilize  from  a  perturbed 
state  to  its  stable  state  (fixpoint)  in  a  one-way  message 
diffusing  time  across  the  perturbed  area  through  local 
coordination  among  nodes  within  ( ^3  R+2R,j  distance 
from  one  another;  second,  local  knowledge  enables 
each  node  to  maintain  the  identities  of  only  a  constant 
number  of  nodes  within  ( f?,  R+2R,j  distance, 
irrespective  of  network  size;  third,  the  head  graph  and 
hexagonal  structure  can  tolerate  multiple  simultaneous 
perturbations  due  to  the  locality  property  of  GS3-D. 

■  Stable  head  level  structure 

In  the  presence  of  dynamic  nodes,  the  head  level 
structure  is  stable  in  the  following  senses:  1)  In  the  case 
of  node  join,  the  head  level  structure  remains 
unchanged  except  for  the  possibility  that  the  head  of 
some  cell  is  replaced  by  a  new  node  if  the  new  node 
better  serves  as  head;  2)  Node  leave  within  a  cell  is 
masked  within  the  cell  by  head  shift  such  that  the  rest 
of  the  structure  remains  unchanged;  3)  In  the  case  of 


node  death  such  that  candidate  sets  of  many  cells  die, 
independent  cell  shift  at  each  cell  enables  the  head 
level  structure  to  slide  as  a  whole  but  maintain 
consistent  relative  location  among  cells  and  heads, 
which  lengthens  the  lifetime  of  the  structure  by  a  factor 
of  T2(nc),  where  nc  is  the  number  of  nodes  in  a  cell;  4) 
In  case  intra-cell  maintenance  fails,  inter-cell 
maintenance  enables  a  system  to  stabilize  to  its  stable 
state  within  a  one-way  message  diffusing  time  across 
the  perturbed  area;  5 )  In  case  of  state  corruption,  sanity 
checking  ensures  that  the  erroneous  state  is  corrected 
by  checking  the  hexagonal  properties  among  heads. 

5.  MOBILE  DYNAMIC  NETWORK 

5.1  Concepts 

Recall  that  in  mobile  dynamic  networks  not  only  can 
nodes  be  dynamic,  but  they  can  also  move.  The 
probability  of  movement  is  inversely  related  to  the 
distance  of  movement.  In  this  section,  we  extend  GS3- 
D  to  GS3-M  to  deal  with  node  mobility. 

Conceptually,  node  mobility  is  modeled  as  a 
correlated  node  join  (at  the  new  location)  and  leave 
(from  the  old  location).  GS3-D  is  easily  adapted  to  deal 
with  the  mobility  of  small  nodes  (more  detailed 
description  is  given  in  Appendix  2).  Thus,  we  focus  on 
how  to  deal  with  big  node  movements. 

In  mobile  dynamic  networks,  the  head  graph  needs 
to  be  maintained  such  that,  in  spite  of  the  movement  of 
the  big  node  H0,  it  is  connected  and  the  path  between 
H0  and  every  head  is  of  minimum  distance.  To  achieve 
this,  the  closest  head  to  H0  in  the  network  acts  as  the 
proxy  of  H0  during  the  time  when  H0  itself  is  not  a 
head,  and  the  distance  from  the  proxy  to  H0  is  set  as  0. 
Then,  just  by  algorithm  GS-D,  the  head  graph  can  be 
maintained  as  a  minimum  distance  tree  to  the  proxy, 
and  thus  every  head  is  of  minimum  hops  to  H0. 
Moreover,  the  impact  of  the  movement  of  H0  on  the 
head  graph  is  contained  within  a  local  range  of  radius 
V3  d/2,  where  d  is  the  distance  H0  moves. 

5.2  Algorithm 

Overview  In  mobile  dynamic  networks,  if  the  big 
node  H0  moves  more  than  Rt  away  from  the  IL  of  its 
cell,  it  retreats  from  the  head  role,  and  transits  to  status 
big_move  where  it  moves  around  and  maintains  a 
proxy-relationship  to  its  proxy.  Whenever  H0  moves 
within  Rt  distance  to  the  IL  of  a  cell  later,  it  replaces 
the  existing  head  of  the  cell  to  act  as  head. 

Algorithm  modules  Compared  with  GS3-D,  GS3-M 
has  a  new  module  BIG_MOVE,  modified  big  node, 
intra-cell  maintenance,  and  inter-cell  maintenance,  as 
shown  in  Figure  7  (a  more  detailed  description  is  given 
in  Appendix  2). 


Program  Big_node 

GS3-D  with  removed  BIG_SLIDE,  modified  intra-cell  as  well  as  inter-cell 
maintenance  modules 

[] 

/*  During  status  of  “big  move”  */ 

c\=big_move — >B  IG_MO VE  //remain  status  bigjnove,  or  transit  to  status  head 
Program  Small _node 

GS3-D  with  modified  intra-cell  as  well  inter-cell  maintenance  modules 


Figure  7:  Self-configuration  algorithm  for  dynamic  mobile  networks 
(GS-’-M) 

5.3  Analysis 

5.3.1  Invariant  &  Fixpoint 

The  invariant  as  well  as  fixpoint  of  GS3-D  is  preserved 
in  GS3-M,  except  for  one  more  fixpoint  predicate  F5  for 
GS3-M  as  follows. 

Fs  (Proxy  optimality):  The  big  node  H0  chooses  the  best 
neighboring  head  as  its  proxy,  i.e. 

(V  head  i  :  proxy  of  Ho  better  than  i) 

Theorem  9:  Ml  is  an  invariant  of  algorithm  GS-M, 
where  Ml  =  DI  (invariant  of  GS3-D). 

Theorem  10:  MF  is  a  fixpoint  of  algorithm  GS-M, 
where  MF  =  DF  (fixpoint  of  GS3-D)  a  F5. 

5.3.2  Self-stabilization 

Theorem  11:  When  the  big  node  moves  from  point  A 
to  B  on  a  plane,  its  impact  on  the  head  graph  Gh  is 
contained  within  a  circular  area  entered  at  point  C  and 
of  radius  ^3  d/2,  where  C  is  the  midpoint  of  segment 
AB  and  d  is  the  cartesian  distance  between  A  and  B. 
Theorem  12:  Starting  from  any  state,  every 
computation  of  GS3-M  reaches  a  state  where  Ml  holds 
within  time  0(DC),  where  Dc  is  the  diameter  of  a 
continuous  state-corrupted  area. 

Theorem  13:  Starting  from  any  state  where  MI  holds, 
every  computation  of  GS3-D  reaches  a  state  where  MF 
holds  within  time  0(max{(Dd/c/),  Td}),  where  cj  is  the 
average  speed  of  message  diffusing  and  Td  is  the 
maximum  difference  between  the  lifetime  of  the 
candidate  set  of  two  neighboring  cells. 

Theorem  12  and  13  imply 

Corollary  7:  Starting  from  any  state,  every  computation 
of  GS-M  reaches  a  state  where  MF  holds  within  time 
0(max{(Dd/c/),  Td}). 

5.3.3  System  stability 

In  mobile  dynamic  networks,  node  mobility  is  dealt 
as  a  special  kind  of  node  dynamics.  So  the  stability 
property  of  the  head  level  structure  and  head  graph  in 
dynamic  networks  is  preserved  in  mobile  dynamic 
networks.  The  invariant  and  fixpoint  of  GS-M  only 
depend  on  local  coordination,  which  enables  them  to 
tolerate  high  degree  of  node  mobility  because  local 
coordination  converges  fast. 
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6.  RELATED  WORK 

In  [18],  a  distributed  algorithm  LEACH  is  proposed, 
but  it  offers  no  guarantee  about  placement  and  the 
number  of  cluster  heads  in  a  system.  Moreover,  the 
clustering  operation  is  periodically  repeated  globally  in 
the  system  over  its  lifetime.  In  [3],  a  distributed 
algorithm  for  clustering  in  wireless  networks  is 
designed,  but  it  only  considers  logical  radius  (hops)  of 
clusters,  instead  of  their  geographic  radius,  which 
makes  long  intra-cluster  link  possible.  Also,  its 
convergence  under  perturbations  depends  on  multiple 
rounds  of  message  diffusion,  instead  of  the  one-way 
diffusion  within  perturbed  areas  as  in  our  algorithm. 
Moreover,  given  certain  node  density  in  a  network,  the 
geographic  radius  in  our  algorithm  implicitly 
guarantees  the  logical  radius  of  clusters.  In  [4],  an 
access-based  clustering  algorithm  is  presented  that 
focuses  on  the  stability  of  clusters,  but  the  algorithm 
does  not  consider  the  size  of  clusters  and  it  requires 
GPS  at  every  node. 

In  [10],  a  cellular  hexagon  structure  is  described 
for  cellular  networks,  but  it  is  pre-configured  and  there 
is  no  self-healing  consideration.  In  [11,12],  different 
algorithms  for  topology  control  in  networks  are 
developed,  but  they  are  either  centralized  or  semi- 
centralized,  and  thus  not  scalable. 

In  [7-9],  algorithms  for  topology  control  in 
wireless  networks  for  energy  saving  are  developed.  In 
[13],  adaptive  fidelity  control  and  routing  algorithms 
are  developed  for  wireless  sensor  networks.  Our  self¬ 
configuration  algorithm  provides  a  stable  network 
infrastructure  for  tasks  such  as  routing  or  power 
control,  and  is  thus  orthogonal  to  these  works. 

[19]  proposes  an  algorithm  for  fault-local  mending 
in  time,  but  it  is  not  local  in  space.  [20]  proposes  the 
application  of  local  detection  paradigm  to  self¬ 
stabilization,  but  it  is  not  local  in  time  even  though  it  is 
local  in  space.  The  self-healing  in  GS3  is  local  both  in 
time  and  in  space. 

7.  CONCLUSION 

In  this  paper,  we  have  presented  an  algorithm  (GS3) 
for  self-configuring  a  network  into  cells  of  tightly 
bounded  geographic  radius  and  low  overlap  between 
cells.  GS3  enables  network  nodes  to  organize 
themselves  into  a  cellular  hexagon  structure  with  a  set 
of  proved  properties.  GS3  is  self-healing,  and  thus 
applicable  to  both  static  networks  and  networks  with 
dynamic  as  well  as  mobile  nodes.  GS3  is  also  scalable 
because  of  its  local  knowledge,  local  self-healing,  and 
local  coordination  properties.  GS3  yields  a  stable 
structure  even  in  the  presence  of  dynamic  and  mobile 
nodes,  which  enables  a  more  available  infrastructure 


for  other  system  services  such  as  routing,  power 
control,  QoS  etc. 

Our  algorithm  is  readily  extended  to  the  following 
cases:  1)  in  a  mobile  dynamic  network  where  there  are 
multiple  big  nodes,  by  letting  each  small  node  maintain 
the  current  big  node  it  chooses,  GS-M  enables  each 
small  node  to  choose  the  best  (e.g.  closest)  big  node  to 
communicate.  2)  Due  to  its  locality  property,  GS3  is 
also  applicable  to  the  case  where  nodes  are  not 
deployed  on  a  2D  plane,  but  where  nodes  within  each 
neighborhood  (e.g.  a  circular  area  of  radius  R)  are 
locally  planar.  3)  GS3  is  also  applicable  to  the  case 
where  the  ideal  cell  radius  R  is  larger  than  the 
maximum  transmission  range  of  small  nodes,  because 
R  does  not  affect  the  correctness  of  the  algorithm. 

GS3  is  local  and  its  convergence  time  is  low,  thus  it 
is  applicable  to  networks  with  high  degree  of  dynamics 
and  mobility.  More  detailed  study  of  dealing  with 
different  degrees  of  node  dynamics  and  mobility  is 
underway. 
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APPENDIX 

In  this  appendix,  we  present  the  complexity  and 
convergence  properties  of  our  algorithm,  description  of 
some  modules  in  GS3-S,  GS3-D  and  GS-M,  the 
invariant  as  well  as  fixpoint  of  GS3-D,  and  proofs  for 
various  theorems  in  this  technical  report. 


Appendix  1:  Complexity  and  convergence 
properties  of  GS3-S/D/M 


Information  maintained  at  each  node 

0(log  n) 

Factor  of  lengthened  lifetime  of  head  level 
structure  by  intra-cell  &  inter-cell 
maintenance 

0(nc) 

Convergence  time  under  perturbations 

0(DP) 

Convergence  time  to  the  stable  state  in 
static  networks 

0(Db) 

Convergence  time  from  any  state  to  the 
stable  state  in  dynamic/mobile  networks 

0(Dd) 

n:  the  number  of  nodes  in  a  system; 
nc:  the  number  of  nodes  in  a  cell; 

D  d:  max{dist(i,  j):  i  and  j  are  small  nodes,  and  dist(i, 
j)  is  the  cartesian  distance  between  i  and  j } ; 

Dp:  the  diameter  of  a  contiguous  perturbed  area; 

Db:  max{dist(H0,  i):  i  is  a  small  node,  and  dist(H0,i) 
is  the  cartesian  distance  between  the  big  node  H0 
and  i } . 

Appendix  2:  Description  of  modules  in  GS3-S, 
GS3-D  and  GS3-M 

In  this  subsection,  we  give  more  detailed  description  of 
some  algorithm  modules  in  GS3-S,  GS3-D  and  GS3-M 
as  follows.  The  complete  program  is  presented  in  [14]. 

1)  Algorithm  GS3-S 

a)  HEAD_ORG  (LD,  RD,  R,  Rt) 

There  are  four  arguments  to  HEAD_ORG:  1)  L 
direction  (LD)  and  R  direction  (RD)  with  respect  to 
direction  p(i)j  (see  Figure  3).  LD  and  RD  determine 
the  search  region  of  a  head  in  the  process  of  organizing 
its  neighboring  cell  heads.  2)  ideal  radius  R  and  radius 
tolerance  Rt. 


The  function  of  HEAD_ORG  executed  by  a  head  i 
is  for  head  i  to  organize  the  neighboring  cell  heads  in 
its  search  region.  HEAD_ORG  executed  by  head  i 
works  as  follows:  first,  head  i  reserves  wireless 
channel  and  broadcasts  message  org  within  ( ^3  R+2Rt) 
distance;  second,  head  i  listens  to  replies  (message 
org_reply  or  head_org_reply )  from  nodes  no  more 
than  ( ^3  R+2Rt)  away  and  within  (LD,  RD)  search 
region  for  certain  amount  of  time  and  calculates  the  set 
of  small  nodes  and  head  nodes  ( SmallNodes  and 
ExistingHeads  respectively)  in  the  search  region; 
Third,  using  the  low  level  module  HEAD_SELECT  (see 
Figure  3),  head  i  selects  neighboring  cell  heads 
HecidSet ;  fourth,  head  i  broadcasts  message  ( HeadSet ) 
to  nodes  within  ( y  3  R+2R,)  distance,  revokes  channel 
reservation,  and  transits  to  status  work. 

In  HEAD _SELECT  executed  by  head  i,  head  i 
needs  to  select  neighboring  cell  heads  in  its  search 
region.  It  achieves  this  in  two  steps:  first,  it  calculates 
the  ideal  locations  for  those  possible  neighboring  cell 
heads;  second,  for  each  possible  neighboring  cell,  if 
there  is  any  small  node  that  is  in  the  R,-radius  circular 
area  centered  by  the  ideal  location  of  the  cell,  select 
the  highest  ranked  such  node  as  the  cell  head.  The 
algorithm  is  described  in  Figure  3  and  its  time 
complexity  is  6{\SmaUNodes\). 

b)  HEAD_ORG_RESP 

When  a  head  node  i  (at  status  head  or  work,  and 
not  including  the  big  node)  receives  a  message  org 
from  a  head  j,  it  replies  with  a  message 
head_org_reply,  and  waits  until  head  j’s  HEAD_ORG 
process  finishes  (by  overhearing  its  message 
{HeadSet)).  No  status  transition  in  this  module. 

c)  ASSOCIATE_ORG_RESP 

When  a  small  node  i  is  at  status  bootup  or 
associate,  it  will  execute  ASSOC IATE_ORG_RESP 
process  upon  receiving  a  message  org  from  a  head  j .  If 
node  i  is  at  status  bootup  or  status  associate  but  head  j 
is  better  (such  as  closer,  with  higher  remaining  energy) 
than  its  current  head  H(i),  node  i  replies  a  message 
org_reply  to  head  j .  Then  waits  for  head  j  ’  s  message 
{HeadSet).  If  node  i  is  selected  as  a  cell  head,  it  sets 
head  j  as  its  parent  head,  and  transits  to  status  head; 
otherwise,  node  i  sets  head  j  as  its  head,  and  transits  to 
status  associate.  On  the  other  hand,  if  node  i  fails  to 
hear  the  message  {HeadSet)  from  head  j  after  a  certain 
amount  of  time,  it  transits  back  to  its  status  at  the 
beginning  of  the  process  (i.e.  bootup  or  associate). 
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2)  Algorithm  GS3-D 

Intra-cell  maintenance 

a)  HEAD_INTRA_CELL 

In  HEAD_INTRA_CELL  executed  by  a  head  i,  head 
i  executes  the  following  actions: 

i.  It  periodically  broadcasts  message 
head_intra_alive  within  its  cell,  and  updates  its 
candidate  as  well  as  associate  set  according  to 
replies  from  the  associates  in  its  cell. 

ii.  If  head  i  receives  a  message  associate_  alive  or 
associate _retreat  from  an  associate,  it  needs  to 
update  candidate  as  well  as  associate  set  properly. 

iii.  If  i  is  resource  scarce  or  a  candidate  better  serves 
as  head,  i  broadcast  a  message  head_retreat  within 
its  cell  and  retreats  back  to  be  an  associate. 

iv.  If  i  receives  message  replacing_head  from  the  big 
node  H0  or  a  head  candidate  j,  it  retreats  to  be  an 
associate,  and  sets  H0  or  j  as  its  head. 

v.  If  the  candidate  set  of  its  cell  is  weak,  i  calls 
STRENGTHEN_CELL  to  strengthen  it. 

vi.  If  the  distance  IL  of  its  cell  that  of  all  its 
neighboring  cells  deviates  too  much  from  V3R, 
exceeding  certain  threshold  Td,  it  abandons  the  cell 
by  broadcasting  a  message  cell_abandoned  within 
its  cell  and  transiting  to  status  bootup. 

In  STRENGTHEN JCELL.  head  i  first  finds  the  next 
ideal  location  (IL)  of  its  cell  whose  corresponding 
candidate  set  is  not  empty,  according  to  the  cell’s 
current  <ICC,  ICP>  value  and  the  ordering  of  all  ILs  in 
its  cell  (see  Figure  5).  Then  it  calculates  the  new 
candidate  set  with  respect  to  the  new  IL.  Last,  it 
broadcasts  two  messages  ( head_intra_alive  containing 
the  new  candidate  set,  and  head_retreat)  within  its 
cell,  and  retreats  to  be  an  associate.  Time  complexity 
is  0(nc),  where  nc  is  the  number  of  nodes  in  a  cell. 

b)  CANDID ATE_INTRA_CELL 

In  CANDID  ATE_INTRA_CELL  executed  by  a 
candidate  i,  i  executes  the  following  actions: 

i.  Upon  receiving  a  message  head_intra_alive  from  a 
head  j :  if  j  is  its  head,  i  checks  whether  it  is  still  in 
j’s  candidate  set,  and  transits  to  status  associate  if 
not;  otherwise,  replies  a  head_intra_ack  message. 
If  j  is  not  its  head  and  is  better  than  its  current 
head,  i  sends  a  associate _retreat  message  to  its 
current  head  and  associate _alive  message  to  head 

j- 

ii.  If  i  receives  a  message  head_retreat  from  or 
detects  the  failure  of  its  current  head,  it 
coordinates  with  other  candidates  in  this  cell  to 


elect  the  highest  ranked  candidate  as  the  new  head. 
The  head  candidates  in  a  cell  are  ranked  in  the 
same  way  as  that  in  HEAD_SELECT  (see  Section 
3). 

iii.  If  i  receives  a  message  cell_abandoned,  head_ 
retreat _corrupted ,  head_disconnected,  or  syn_cell 
from  its  head,  it  transits  back  to  boot  up  status. 
Inter-cell  maintenance 
a)  HEAD_INTER_CELL 

In  HEAD_INTER_CELL  executed  by  a  head  i,  head 
i  executes  the  following  actions: 

i.  Periodically  broadcasts  message  head_inter_alive 
as  heartbeat  to  its  parent  as  well  children  heads. 

ii.  Upon  receiving  a  message  head_inter_alive  from 
head  j ,  update  children  set,  and  neighboring  head 
set  properly.  If  j  is  not  i’s  parent  head  but  is  better 
(closer  to  the  big  node,  for  example)  than  its 
current  parent  head,  i  sets  j  as  parent  head,  and 
sends  a  message  new_child_head  to  j. 

iii.  If  i  receives  a  message  new_child_head  from  j, 
update  children  heads  set  as  well  neighboring 
heads  set  accordingly. 

iv.  If  a  neighboring  cell  Cn  (including  child  as  well  as 
parent  cell)  has  a  new  head  due  to  intra-cell 
maintenance,  i  updates  neighboring  head  set, 
children  head  set,  or  parent  head  accordingly.  If  C„ 
has  a  newer  <ICC,  ICP>  value,  head  i  synchronizes 
its  cell  to  the  new  <ICC,  ICP>  by  calling 
SYN_CELL  process  (this  is  optional). 

v.  If  i  receives  a  syn_cell  message  from  a  neighboring 
cell’s  head  j,  it  updates  (remove  j)  neighboring 
head  and  child  head  sets  accordingly.  If  j  is  i’s 
parent  head,  i  executes  PARENT_SEEK  to  find  a 
new  parent  head.  If  syn_cell  message  carries  a 
newer  <ICC,  ICP>  value,  i  executes  SYN_CELL. 

vi.  If  i  is  a  boundary  head  and  there  is  no  head  at 
certain  neighboring  cell  area  in  its  search  region,  it 
periodically  executes  HEAD_ORG  to  check 
whether  new  nodes  have  shown  up  in  this 
direction. 

vii.  If  a  child  head  j  fails,  i  executes  HEAD_ORG  in  j’s 
direction,  trying  to  organize  a  new  head. 

viii.  If  i’s  parent  head  P(i)  fails,  and  P(i)’s  failure  has 
not  been  recovered  by  P(i)’s  parent  head,  i 
executes  to  PARENT_SEEK.  If  i  receives  a  message 
parent_seek  from  a  head  j  and  they  don’t  have  the 
same  parent  head,  it  replies  a  parent _seek_cick 
message. 

ix.  If  i  receives  a  message  sanity _check_req  from  a 
neighboring  head  j,  it  checks  its  own  status.  If  its 
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status  is  valid,  i  replies  a  message 
sanity_check_valid  message  to  j;  otherwise,  i 
executes  SANITY_CHECK. 

x.  If  i  receives  a  head _r etr eat _corrupted  message 
from  a  neighboring  cell’s  head  j,  it  updates 
(remove  j)  its  neighboring  head  set  and  children 
head  sets  accordingly.  If  j  is  i’s  parent  head,  i 
executes  PARENT_SEEK. 

In  SYN_CELL ,  head  i  first  calculates  the  new  IL 
with  respect  to  the  new  <ICC,  ICP>  value.  Then  it 
calculates  the  candidate  set  corresponding  to  this  IL.  If 
the  candidate  set  is  not  empty,  i  broadcasts  a  message 
head_retreat  within  its  cell;  otherwise,  it  broadcasts  a 
message  syn_cell  to  its  neighboring  heads  that  includes 
the  current  <ICC,  ICP>  value.  Last,  i  transits  to  status 
big_slide  if  it  is  the  big  node  or  status  associate 
otherwise.  Time  complexity  is  0(C),  where  C  is  a 
constant. 

In  PARENT_SEEK,  let  ST  denote  the  sub-tree  of  Gh 
rooted  at  head  i.  Head  i  ranks  its  neighboring  heads  in 
almost  the  same  way  as  that  in  HEAD_SELECT,  except 
that  i_p(i)  instead  of  GR  is  used  as  reference  direction. 
Then  i  tries  to  find  a  neighboring  head  as  parent  head 
in  an  increasing  order.  If  it  succeeds  in  finding  such  a 
head  j,  i  sets  j  as  its  parent;  otherwise  i  lets  its  children 
heads  on  the  boundary  of  ST’s  geographic  coverage  try 
to  find  a  new  parent  head  in  the  same  way.  If  any  of  its 
child  head  j  succeeds,  i  sets  j  as  its  parent;  otherwise  i 
broadcasts  a  message  head_disconnected  within  its 
cell,  and  transits  back  to  boot  up  status.  Its  time 
complexity  is  O(IFNHI),  where  FNH  denotes  the  set  of 
head  in  (Gh-ST)  that  has  a  neighboring  head  in  ST. 
b)  ASSOCIATE_INTER_CELL 

If  an  associate  (including  both  candidate  and  non¬ 
candidate)  receives  a  message  org,  it  calls 
ASSOCIATE_ORG_RESP. 

Sanity  checking 

In  order  to  deal  with  status  corruption,  every  head 
periodically  executes  SANITY_CHECK.  In  SANITY. 
CHECK  executed  by  head  i,  it  first  checks  if  its  <ICC, 
ICP>  value  is  equal  to  that  of  all  its  neighboring  cells. 
If  yes,  it  checks  whether  its  status  satisfies  the 
hexagonal  relationship  of  the  system  invariant.  If  no,  it 
broadcasts  a  message  sanity _check_req,  and  waits  for 
replies  from  its  neighboring  cells’  heads.  If  all  its 
neighboring  cells’  heads  reply  a  message 
sanity _check_valid,  head  i  broadcasts  a  message 
head_retreat_corrupted  within  its  cell.  If  it  has  not  got 
the  message  sanity _check_valid  from  any  of  its 


neighboring  cells  after  certain  amount  of  time,  head  i 
exit  this  module  without  changing  its  status.  Time 
complexity  is  0(A),  where  A  denotes  the  size  of  the 
contiguously  affected  area. 

3)  Algorithm  GS3-M 

BIG  MOVE 

In  BIG.MOVE,  the  big  node  keeps  listening  to 
heartbeats  ( head_intra_alive  message)  from  all  nearby 
heads,  and  always  chooses  the  best  (closest,  for 
example)  head  as  its  proxy.  When  its  proxy  is  replaced 
by  a  candidate  hn  in  the  proxy’ s  cell,  the  big  node  reset 
its  proxy  as  hn.  When  the  big  node  moves  into  the  Rt- 
radius  circular  area  of  a  cell,  it  replaces  the  existing 
head  as  head,  and  transits  back  from  status  bigjnove  to 
status  work. 

Modified  intra-cell  and  inter-cell  maintenance 

The  modification  to  the  intra-cell  as  well  as  inter¬ 
cell  maintenance  is  to  maintain  the  cell  head,  candidate 
set,  and  big  node’s  proxy  relationship  in  the  presence 
of  mobile  nodes.  As  for  big  node,  if  it  retreats  from  the 
head  role  because  of  the  IL  change  of  any  of  its 
neighboring  cells,  it  transits  to  status  bigjnove  instead 
of  big_slide  in  dynamic  mobile  networks. 

Appendix  3:  Invariant  and  fixpoint  of  GS3-D 
(dynamic  networks) 

1)  Invariant 

The  invariant  of  GS3-D  differs  from  that  of  GS3-S 
at  I2  when  a  cell  and  its  neighboring  cells  have 
different  <ICC,  ICP>  values. 

•  Ii  (connectivity) 

Same  as  in  static  networks. 

•  I2  (Hexagonal  structure) 

■  I2.1:  (for  inner  heads) 

1 2.1  for  static  networks 

A 

(V  inner.head  i:  Vj  e  neighboring_heads(i): 

<ICC(i),ICP(i)>  *  <ICC(j).ICP(j)>  => 

(  (distOL(i),IL(j))-2Rt  <  dist(i,  j)  <  dist(IL(i),IL(j))+2Rt) 

A 

(0  <  dist(IL(i),  IL(j))  <  2  V3  R  ) 

) 

) 

■  I2.2:  (for  boundary  heads) 

1 2.2  far  static  networks 
A 

(V  boundary.head  i:  Vj  e  neighboring_heads(i): 

<ICC(i),ICP(i)>  *  <ICC(j).ICP(j)>  => 

(  (dist(IL(i),IL(j))-2Rt  <  dist(i,  j)  <  dist(IL(i),IL(j))+2Rt) 

A 
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(0  <  dist(mi),  IL(j))  <  2  V3  R  ) 


) 


) 


■  I2.3:  modify  1 2.3  for  static  networks  by  changing  ( V 
head  i:  I  CH(i)  I  <3  )  to  (V  head  i:  I  CH(i)  I  <  5  ) 

■  I2.4:  (cell  radius) 

I 2.2  for  static  networks 
A 

(V  inner  cell  C: 

(3je  neighboring_heads(i):<ICC(i),ICP(i)>  ^  <ICC(j),ICP(j)>)=> 
(V  associate  i  e  C  :  dist(i,  H(i))  <  2R+Rt) 


) 


A 

(V  boundary  cell  C’\  Vassociate  i  eC”:  dist(i,  H(i))  <  ff  R+2Rt+dp) 


•  I3  (Inner  cell  optimality) 
Same  as  in  static  networks. 


2)  Fix  Point 

The  fixpoint  of  GS3-D  differs  from  that  of  GS3-S 
at  Fj  2  that  is  strengthened  in  GS3-D. 

•  F,  (connectivity) 

■  Fu:  Same  as  in  static  networks 

■  F1.2:  Gh  is  a  minimum-distance  (with  respect  to  the 
big  node  H0)  spanning  tree  of  Gh„,  and  Gh  is  rooted  at 
H0. 

F 12  for  static  networks  a 

(V  V;  e  (Vh  -  { H0 } ) :  hops(H0,Vl)  =  MIN(H0,  v.)  ), 

where  MIN(v!,  v2)  is  the  length  (by  hops)  of  the  shortest  path 

between  and  v2  in  Ghn. 

•  F2  (hexagonal  structure) 

F2.i,  F2.2,  and  F2  3  are  the  same  as  in  static  networks. 
F2.4is  relaxed  as: 

(F2.4  of  GS3-S)  a  (IRrandonJ  is  at  most  ((^3 -l)R+2R,+dp)  for 
boundary  cells). 

•  F3  (cell  optimality):  Same  as  in  static  networks. 

•  Ft  (coverage):  Same  as  in  static  networks. 


Appendix  4:  Proofs  for  theorems  in  the  report 

We  present  proofs  for  the  critical  theorems  in  this 
report.  For  the  complete  set  of  proofs,  check  [14]. 

1)  Theorem  1:  SI  is  an  invariant  of  algorithm  GS3_ 
S,  where  SI  =  F  a  I2  a  I3. 

•  Ip  Connectivity  (safety  property  of  head  level 
graph) 

■  Iu:  Any  pair  of  heads  that  are  connected  in  Gh  are 
also  connected  in  Gp,  and  vice  versa. 

(V  Vhi,  vh2  e  Vh:  there  is  a  path  between  vhi  and  Vh2  in  Gh  <=> 
there  is  a  path  between  vhi  and  vh2  in  Gp) 

Proof: 

Gp  only  depends  on  the  nodes  in  the  system  and 
their  communication  capability,  thus  has  nothing  to  do 


with  the  program  actions.  Gh  only  depends  on  the  set 
of  head  nodes  in  the  system  and  the  parent-child 
relationship  among  them.  Thus  the  set  of  actions  that 
are  related  to  Gh  are  those  of  HEAD_ORG, 
HEAD_ORG_RESP,  and  ASSOCIATE_ORG_RESP.  At 
the  same  time,  HEAD_ORG_RESP  and  ASSOCIATE_ 
ORG_RESP  operate  under  the  control  of  HEAD_ORG, 
so  the  critical  module  is  HEAD_ORG. 

In  order  to  prove  this  invariant,  we  only  need  to 
prove  it  is  closed  under  a  round  of  HEAD_ORG, 
HEAD_ORG_RESP,  and  ASSOCIATE_ORG_RESP.  The 
proof  is  as  follows: 

1)  Suppose  Gh’(Vh’,  Eh’)  is  the  Gh  before  a  round 
of  HEAD_ORG,  HEAD_ORG_RESP,  and 
ASSOCIATE_ORG_RESP.  Gh’  and  Gp  satisfy  Iu; 

2)  After  a  round  of  HEAD_ORG, 
HEAD_ORG_RESP,  and  ASSOCIATE_ORG_ 
RESP,  Gh  becomes  Gh2(Vh2,  Eh2). 


Case  one:  Vh’  is  empty 

If  Vh’  is  empty,  Gh2  would  be  such  that 
Vh2  is  the  set  composed  of  the  big  node  H0 
and  its  children  heads  generated  in 
HEAD_ORG  process  and  Eh2  is  the  set  of 
edges  that  goes  from  the  big  node  to  its 
children  heads.  By  the  process  HEAD_ORG, 
the  big  node  and  its  children  heads  are  within 
transmission  range  of  one  another  and  they 
are  at  most  (V3R+2R,)  away  from  each  other. 
Thus  the  big  node  and  its  children  heads  must 
be  directly  connected  in  Gp. 

So  we  only  need  to  prove  that  any  two 
different  heads  hi  and  h2  are  connected  in 
Gp.  And  this  is  obvious  because  both  hi  and 
h2  are  connected  to  H0  in  Gp. 

So  the  claim  holds  in  this  case. 

Case  two:  Vh’  is  not  empty 

If  Vh’  is  not  empty,  there  must  be  a  head 
hi  in  Vh’  such  that  Vh2  =  Vh’  u  CH(hl)  and 
Eh2  =  Eh’  u  {(hi,  j):  j  e  CH(hl)}.  By  the 
proof  of  case  one,  we  can  easily  know  that 
the  claim  holds  for  any  two  nodes  that  are  in 
the  set  of  {hi}  uCH(hl). 

So  we  only  need  to  prove  the  claim 
between  a  node  h2  e  (Vh’  —  {hi })  and  a  node 
h3  g  CH(hl).  If  the  set  (Vh’  -  {hi })  is  empty, 
the  claim  trivially  holds.  If  the  set  (Vh’  - 
{hi })  is  not  empty,  then  there  must  be  a  path 
pi  between  h2  and  hi  in  Gp  and  a  path  p2 
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(actually  just  one  hope  edge)  between  h3  and 
hi.  So  there  must  be  a  path  p3  between  h2 
and  h3  and  p3  is  the  concatenation  of  pi  and 
p2  by  head  node  hi. 

So  the  claim  holds  in  this  case. 

<=: 

By  Ii 2,  Gh  is  a  tree,  thus  any  two  heads  hi 
and  h2  are  connected  in  Gh  and  there  would 
always  be  a  path  between  then  in  Gh-  So  this 
claim  trivially  holds. 

Thus,  after  a  round  of  a  round  of 
HEAD_ORG,  HEAD_ORG_RESP,  and 
ASSOCIATE_ORG_  RESP,  Gh  and  Gp  still  satisfy 

In. 

□ 

■  1 1.2*  Gh  is  a  tree  rooted  at  the  big  node  H0.  That  is, 

(hops(H0)  =  0)  a  (P(H0)  =  H0)  a 

(V  Vi  e  (Vh  -  { H0 } ) :  (there  is  a  path  between  Vj  and  H0)  => 
(hops(H0,  V;)  =  hops(H0,  P(Vi))+l)  a 

(V  V;,  Vj  e  Vh:  there  is  a  path  between  V;  and  Vj  in  Gh)  a 

(V  Vi,  Vj  e  Vh:  there  is  a  path  of  length  no  fewer  than  2 
between  V;  and  Vj  =>  (P(vj)  ^  Vj  a  P( Vj)  ^  v;)), 

where  hops(vi,  V2)  denotes  the  length  of  the  path 
from  Vi  to  V2  in  Gh- 

Proof: 

Same  as  the  analysis  in  the  proof  of  I^,  the 
modules  that  can  affect  this  invariant  are  HEAD_ORG, 
HEAD_ORG_RESP,  and  ASSOCIATE_ORG_RESP. 

3)  Suppose  Gh’(Vh\  Eh’)  is  the  Gh  before  a  round 
of  HEAD_ORG,  HEAD_ORG_RESP,  and 
ASSOCIATE_ORG_RESP,  and  Gh’  satisfies 
I1.2; 

4)  After  a  round  of  HEAD_ORG, 
HEAD_ORG_RESP,  and  ASSOCIATE_ORG_ 
RESP,  Gh  becomes  Gh2(Vh2,  Eh2). 

Case  one:  Vh’  is  empty 

If  Vh’  is  empty,  Gh2  would  be  such  that 
Vh2  is  the  set  composed  of  the  big  node  H0 
and  its  children  heads  (CEl(Ho))  generated  in 
HEAD_ORG  process  and  Eh2  is  the  set  of 
edges  that  goes  from  H0  to  nodes  in  CH(H0). 
By  the  way  HEAD_ORG  works,  for  any  node 
h  e  CH(H0),  hops(h)  would  be  1 .  For  any  two 
different  heads  hi,  h2  e  CH(H0),  (P(hl)  *  h2 
a  P(h2)  A  hi))  must  hold. 

So  the  claim  holds  in  this  case. 

Case  two:  Vh’  is  not  empty 


If  Vh’  is  not  empty,  there  must  be  a  head 
hi  in  Vh’  such  that  Vh2  =  Vh’  u  CH(hl)  and 
Eh2  -  Eh’  u  {(hi,  j):  j  e  CH(hl)}.  By  the 
proof  of  case  one,  we  could  easily  know  that 
the  claim  holds  for  the  set  of  heads  of  {hi }  u 
CH(hl).  So  we  only  need  to  prove  the  claim 
between  a  node  h2  e  (Vh’  —  {hi })  and  a  node 
h3  e  CH(hl). 

If  the  set  (Vh’  -  {hi })  is  empty,  the  claim 
trivially  holds. 

If  the  set  (Vh’  -  {hi})  is  not  empty,  then 
there  must  be  a  path  pi  between  h2  and  hi  in 
Gh  and  a  path  p2  (actually  just  one  hope 
edge)  between  h3  and  hi.  So  there  must  be  a 
path  p3  between  h2  and  h3  in  Gh  and  p3  is  the 
concatenation  of  pi  and  p2  by  head  hi.  At 
the  same  time,  h2  must  have  a  parent  head 
P(h2)  e  Vh’,  P(h3)  is  hi  that  is  different  from 
h2,  and  h3  £  Vh’.  So  (P(h3)  ±  h2  a  P(h2)  A 
h3))  must  hold. 

So  the  claim  holds  in  this  case. 

Thus,  after  a  round  of  a  round  of  HEAD_ORG, 
HEAD_ORG_RESP,  and  ASSOCIATE_ORG_  RESP, 
Gh  and  Gp  still  satisfy  Ii.2. 


□ 


•  I2:  Hexagonal  map  of  heads  and  inner  cells 

■  I2.i:  Each  inner  cell  head  i  has  exactly  6  neighboring 
heads  that  form  a  cellular  hexagon  centered  by  head 
i  and  of  edge  length  V3R,  with  vertices’  location 
deviation  at  most  Rt. 

(V  inner  cell  head  i: 

(I  neighboring_heads(i)  I  =  6)  a 

(Vje neighboring_heads(i):  R-2R,  <  dist(i,  j)  <  f}R+2Rt  ) 

) 

Proof: 

Same  as  the  analysis  in  the  proof  of  h,  the  modules 
that  can  affect  I2.i  are  HEAD_ORG,  HEAD_ORG_RESP, 
and  ASSOCIATE_ORG_RESP. 

Suppose  I2.i  holds  before  a  round  of  HEAD_ORG, 
HEAD_ORG_RESP,  and  ASSOCIATE_ORG_  RESP 
execution.  We  just  need  to  prove  that  after  the 
execution  of  a  round  of  HEAD_ORG,  HEAD_ORG_ 
RESP,  and  ASSOClATE_ORG_RESP,  initiated  by  a  head 
i  that  executes  HEAD_ORG,  I2.i  still  holds.  Because  this 
round  of  head  organization  will  only  affect  head  i  and 
its  children  heads  ii,  i2,  i3,  we  only  need  to  prove  that 
the  I2 1  holds  for  head  i,  i1?  i2,  and  i3.  Let’s  first  consider 
head  i. 
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1)  head  i  is  an  inner_head  =>  I 
neighboring_heads(i)  I  =  6 

a)  if  head  i  is  the  big  node,  this  claim  holds 
obviously  just  by  the  way  the  process 
HEAD_ORG  works; 

b)  if  head  i  is  a  small  head  node,  we  can  get  the 
picture  below  from  the  design  of  HEAD_ORG 
and  the  program  of  Big  Node  and  Small 
Node. 


From  the  picture  above,  we  can  see  that 
head  i  has  3  next -band  heads  (ii,  i2,  i2),  1 
parent  head  (P(i)),  and  2  neighboring  heads 
(p,i-  pa)  at  the  same  band  that  are  under  the 
care  of  the  same  parent  head  as  head  i,  even 
though  they  might  not  be  generated  by  P(i). 
Thus  node  i  has  6  neighboring  heads  around 

within  ( V3  R+2Rt)  radius. 

Also  it  is  easy  to  see  that  head  almost 
centers  the  hexagon  formed  by  its  6 
neighboring  heads,  with  possible  deviation  at 
most  Rt. 

2)  head  i  is  an  inner.head  =>  (Vj  e 
neighboring_heads(i):  V3R-2Rt)  <  dist(i,  j)  < 

V3R+2Rt) 

From  HEAD_ORG  and  the  picture  above, 
we  can  see  that:  for  all  neighboring  head  j  of 
node  i,  dist(IL(i),  IL(j))  =  V3R.  At  the  same 
time  “dist(k,  IL(k))  <  Rt”  holds  for  any  head  k, 
thus  “  V3R-2  Rt  <  dist(i,  j)  <  V3R+2  Rt”  holds 
too. 

As  for  head  ii,  i2,  and  i3,  we  can  prove,  in  the  same 
way  as  above  for  head  that  I2 1  also  holds  for  them. 

Thus  I2.i  still  holds  after  a  round  of  a  round  of 
HEAD_ORG,  HEAD_ORG_RESP,  and  ASSOCIATE. 
ORG.RESP  execution. 

□ 

■  I2.2:  Each  boundary  head  i  has  less  than  6 
neighboring  heads,  and  the  distance  between  i  and 
its  neighboring  heads  is  hexagonally  bounded.  That 

is, 


(V  boundary  .head  i:  I  neighboring_heads(i)  I  <  6)  a 
(V  boundary.head  i:  (Vj  e  neighboring_heads(i):  V3  R-2  R,  < 
dist(i,  j)  <  V3  R+2  R, ) 

Proof: 

Since  we  have  proved  that  I2.i  is  an  invariant,  we 
just  need  to  prove  that  I21  =>  I2.2  in  proving  that  I22  is 
an  invariant.  The  proof  of  I21  =>  I2  2  is  as  follows: 

Boundary  heads  are  generated  in  the  same  way  as 
inner  heads.  The  only  difference  is  that  their  cells  are 
on  the  boundary  of  the  system’s  geographic  coverage 
such  that  there  is  no  neighboring  head  in  certain 
(60+2a)°  region  around  itself,  where  a  denotes  the 
angular  deviation  corresponding  to  the  Rt  head’s 
location  deviation.  Since  each  inner  head  has  exactly  6 

neighboring  heads  in  its  ( V3  R+2Rt)  radius,  each 
boundary  head  should  have  less  than  6  neighboring 
heads  in  its  ( V3  R+2Rt)  radius.  And  the  distance 
between  boundary  head  i  and  its  neighboring  heads  is 
bounded  in  the  same  way  as  inner  head  does. 

□ 

■  1 2.3:  Each  head,  except  for  the  big  node,  has  no  more 
than  3  children  heads.  The  big  node  H0  has  6 
children  heads  if  it  is  not  on  the  system’s  boundary 
and  it  would  have  1~5  children  heads  if  it  is  on  the 
boundary  of  the  system  but  not  disconnected  from 
the  small  nodes.  That  is, 

(V  head  i:  I  CH(i)  I  <  3  )  a 

(H0  is  not  on  the  boundary  of  system  coverage  =>  (  ICH(H0)l  =  6  )) 

A 

(H0  is  on  the  boundary  of  system  coverage  but  not  disconnected  => 
(  1  <  I  CH(H0)  I  <  5  )) 

Proof: 

The  modules  that  can  affect  I2.3  are  HEAD.ORG, 
HEAD.ORG.RESP,  and  ASSOCIATE.ORG.  RESP. 

Suppose  I2.3  holds  before  a  round  of  HEAD.ORG, 
HEAD.ORG.RESP,  and  ASSOCIATE.ORG.  RESP 
execution.  We  just  need  to  prove  that  after  the 
execution  of  a  round  of  HEAD.ORG, 
HEAD.ORG.RESP,  and  ASSOCIATE.ORG.RESP, 
initiated  by  a  head  i  that  executes  HEAD.ORG,  I2.3 
still  holds.  Because  this  round  of  head  organization 
will  only  affect  head  i  and  its  children  heads  p,  i2,  i3, 
and  we  are  only  considering  a  head’s  children  heads, 
we  only  need  to  prove  that  the  I23  holds  for  head  i. 

If  head  i  is  not  the  big  node,  from  the  design  of 
HEAD.ORG,  its  search  region  is  only  180°.  Ideally 
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there  would  be  only  one  head  in  60°,  thus  at  most  there 
would  be  no  more  than  three  next-band  heads  (children 
heads)  initiated  by  head  i.  Also,  if  the  default  value  of 
Rt  is  R/4,  the  way  HEAD_.ORG  works  also  guarantees 
that  no  more  than  three  next-band  heads  initiated  by  i. 

If  head  i  is  the  big  node,  its  search  region  is  360°, 
thus  it  would  have  6  children  heads  if  the  big  node  is 
not  at  the  boundary  of  the  system’s  geographic 
coverage.  If  it  is  at  the  boundary  of  the  system  but  not 
disconnected,  the  big  node  H0  would  have  1-5 
children  heads  because  there  is  no  neighboring  head  in 
certain  (60+2a)°  region  around  the  big  node,  where  a 
denotes  the  angular  deviation  corresponding  to  the  Rt 
head’s  location  deviation. 

Thus  I2.3  still  holds  after  a  round  of  a  round  of 
HEAD_ORG,  HEAD_ORG_RESP,  and  ASSOCIATE. 
ORG.RESP  execution. 

□ 


■  I2.4:  Each  cell  is  of  radius  (R+Rrandom),  where  IRrand0ml 
is  at  most  (2Rt  /,/ 3).  And  each  associate  is  of 
(R+Rrandom)  distance  to  its  head. 

(V  cell  C:  Vassociate  i  e  C  :  R-(2R J  )  <  dist(i,  H(i))  <  R+(2Rt/V3  )) 
Proof: 

The  modules  that  can  affect  I24  are  HEAD.ORG, 
HEAD.ORG.RESP,  and  ASSOCIATE.ORG.  RESP. 

Suppose  I2.4  holds  before  a  round  of  HEAD.ORG, 
HEAD.ORG.RESP,  and  ASSOCIATE.ORG.RESP 
execution.  We  just  need  to  prove  that  after  this  round 
of  execution  of  these  modules,  initiated  by  a  head  i 
that  executes  HEAD.ORG,  I24  still  holds.  This  round  of 
head  organization  can  affect  head  i,  its  possible 
children  heads  ih  i2,  i3,  its  parent  head  P(i),  and  the  two 
neighboring  heads  (pn,  pi3)  at  the  same  band  that  are 
under  the  care  of  the  same  parent  head  as  head  i,  and 
their  covered  cells,  as  shown  in  the  picture  below.  But 
we  only  need  to  prove  that  the  I2  3  holds  for  the  cell  C; 
covered  by  head  i  without  loss  of  generality,  because 
we  can  prove  that  I2  3  holds  for  all  other  related  cells  in 
the  same  way  as  for  cell  C). 

P(')  . 


0"  V3 R+2Rt 

If  head  i  is  an  inner  cell  head  and  thus  C,  is  an 
inner  cell,  then  head  i  is  surrounded  by  six  neighboring 


heads  as  shown  above.  Then  C,  is  also  surrounded  by 
six  neighboring  cells.  So,  any  point  in  C,  will  lie  in  the 
triangle  formed  by  head  i  and  two  of  its  immediately 
neighboring  heads  (ii  and  i2,  for  example),  as  shown  in 
the  following  figure.  According  to  the  way 
ASSOCIATE.ORG.RESP  works,  any  point  in  this 
triangle  chooses  the  closest  head  to  join.  Thus,  the 
maximum  distance  between  a  point  in  head  i’s  cell  and 
head  i  is  (R+2Rt  /  fi),  as  shown  in  the  figure.  Thus,  the 
radius  for  any  inner  cell  is  at  most  (R+2R,  I  )• 
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Thus  I24  still  holds  after  a  round  of  a  round  of 
HEAD.ORG,  HEAD.ORG.RESP,  and  ASSOCIATE. 
ORG.RESP  execution. 

□ 

•  I3:  Inner  Cell  Optimality  (for  associate  nodes) 

■  Each  associate  node  in  an  inner  cell  chooses  the  best 
(closest,  most  remaining  energy,  etc.)  neighboring 
head  to  join.  That  is, 

(V  associate  i  in  any  inner  cell:  V  head  j  ^  H(i)  (H(i)  better  than  j)) 
Proof: 

The  modules  that  can  affect  I3  are  HEAD.ORG 
and  ASSOCIATE.ORG.RESP. 

Suppose  I3  holds  before  a  round  of  HEAD.ORG 
and  ASSOCIATE.ORG.RESP.  We  just  need  to  prove 
that  after  this  round  of  execution  of  these  modules, 
initiated  by  a  head  i  that  executes  HEAD.ORG,  I3  still 
holds.  Because  HEAD.ORG  only  happens  at  boundary 
heads  at  any  moment,  any  round  of  HEAD.ORG 
execution  could  only,  from  the  perspective  of  I3,  affect 
those  associates  that  was  in  a  boundary  cell  before  the 
execution  but  is  in  an  inner  cell  after  the  execution. 
For  any  such  associate  node  j,  it  must  have  chosen  the 
best  head  around  it  as  its  head  because  the  way 
ASSOCIATE.ORG.  RESP  works.  So  13  holds  for 
every  such  associate  j . 

Thus  13  holds  after  any  round  of  HEAD.ORG  and 
ASSOCIATE.ORG.RESP  execution. 

□ 
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2)  Theorem  3:  Starting  from  any  state,  every 
computation  of  GS3-S  reaches  a  state  where  SI 
holds  within  a  constant  amount  of  time.  That  is, 

■  TRUE  leads  to  Invariant  (lx  a  I2  a  Is) 

Proof: 

In  order  to  prove  “TRUE  leads  to  Invariant”,  we 

just  need  to  prove  “Invariant  leads  to  Invariant” 
because  “Invariant  leads  to  Invariant”  is  obvious. 

Because  Invariant  (T  a  U)  is  closed  under  all  the 
program  actions  and  there  is  no  state  corruption  in 
static  networks  (according  to  the  definition),  the 
system  will  not  be  able  to  reach  any  state  where 

Invariant  would  hold.  Thus  Invariant  is  FALSE 

all  the  time.  So  “ Invariant  leads  to  Invariant”  is 
equal  to  “FALSE  leads  to  Invariant”  that  is  trivially 

true.  Therefore,  “ Invariant  leads  to  Invariant”  is 
true. 

According  to  the  analysis  above,  “TRUE  leads  to 
Invariant”  hold. 

□ 

3)  Theorem  4:  Starting  from  any  state  where  SI 
holds,  algorithm  GS3-S  reaches  a  state  where  SF 
(SF  =  FiA  F2aF3aF4)  holds,  and  the  convergence 
time  is  0(Db),  where  Db  =  max{dist(H0,  i):  i  is  a 
small  node  and  dist(H0,i)  is  the  cartesian  distance 
between  H0  and  i}.  That  is, 

■  Invariant  (lx  a  I2  a  I3)  leads  to  fix  point  (Fj  a  F2  a 
F3  A  F4) 

Proof: 

a)  Invariant  (lx  a  I2  a  I3)  leads  to  F3 

We  only  need  to  prove  that  T  a  U  a  I3  a  F3  leads 

to  F3,  since  F3  naturally  leads  to  F3,  and  Ij  as  well  as  I2 
is  invariant. 

For  any  associate  node  i,  the  scenario  where  F3 

could  hold  is  when  some  better  neighboring  head  j 
around  it  is  still  at  state  qhead  and  has  not  carried  out  the 
process  HEAD_ORG  yet.  Because  HEAD_ORG  and 
HEAD_ORG_RESP  guarantee  that  two  neighboring 

heads  within  ( V3  R+2Rt)  range  cannot  initiate 
HEAD_ORG  in  parallel,  associate  i  is  able  to  hear  the 
ORG  messages  from  all  its  neighboring  heads, 
including  head  j.  The  way  ASSOC IATE_ORG_RESP 
works  guarantees  that  associate  i  will  choose  the  best 
(such  as  closest,  highest  remaining  energy,  etc.)  head 


to  associate  with  after  all  such  better  heads  js  finish 
their  HEAD_ORG  process.  So  F3  will  be  false  and  F3 

will  be  true  after  all  the  better  neighboring  heads 
around  associate  i  finish  their  HEAD_.ORG  processes. 
Suppose  the  number  of  better  heads  around 

associate  i  is  BETTER_HEAD  when  F3  is  true.  Then 

BETTER_HEAD  is  no  less  than  0.  When  F3  is  true, 

at  least  one  HEAD_ORG  process  is  enabled,  and 
whenever  a  HEAD_.ORG  process  finishes,  the  value  of 
BETTER_HEAD  will  decrease  by  1.  Thus,  it  only 
takes  B  ETTER_HE  AD  rounds  of  HEAD_ORG 

process  for  associate  i  to  transfer  from  state  F3  to 
state  F3,  which  is  a  finite  procedure.  Thus  “T  a  I2  a 
F3  leads  to  F3”  holds. 

Since  it  only  takes  finite  time  Chead_org  for  a 
HEAD_ORG  process  to  finish,  the  state  transition 

from  F,  to  F3  would  only  take  BETTER_HEAD  x 

(Chead_org  +  Cgap)  (i.e.  0(BETTER_HEAD))  amount  of 
time,  where  Cgap  denotes  the  maximum  interval 
between  two  neighboring  heads’  HEAD_ORG  process. 


b)  Invariant  (E  a  U  a  I3)  leads  to  Fx  a  F2 

If  we  could  prove  that  T  a  I2  a  I3  =>  F2.4,  then  “T  a 
I2  a  I3  leads  to  F 2.4”  holds,  which  also  means  “Invariant 
(Ii  a  I2  a  I3)  leads  to  Fx  a  F2”  since  1 1  is  the  same  as  Fx 
and  F2  is  equal  to  I2  a  F2  4. 

Now  let’s  prove  T  a  I2  a  I3  =>  F24.  Because  I24  = 
F2  4  a  (There  is  no  Rt  -radius  gap  in  the  system  =>  R’  < 
2 

R+— R  t),  we  only  need  to  prove  that  T  a  I2  a  I3  => 


s 


R’  < 


(There  is  no  R,  -radius  gap  in  the  system 

2 

R+— =Rt).  According  to  the  way  HEAD_ORG  works, 

V3 

the  boundary  cell  would  be  no  bigger  than  the  inner 
cell,  if  there  is  no  Rt  -radius  gap.  Otherwise,  the 
HEAD_ORG  process  will  be  continuously  initiated. 
Thus  the  boundary  cell’s  radius  is  still  no  more  than 
2 

(R+— =Rt)  according  to  I24  that  says  any  inner  cell’s 

V3 


radius  is  no  more  than  (R+— =Rt). 

v/3 

c)  Invariant  (lx  a  I2  a  I3)  leads  to  F4 


We  only  need  to  prove  that  F  a  I2  a  I3  a  — iF4  leads 
to  F4,  since  it  is  obvious  that  F  a  I2  a  I3  a  F4  leads  to 
F4. 

Since  the  way  HEAD_ORG  works  guarantees  that 
all  the  visible  areas  of  the  system  can  be  covered  by 
the  HEAD_ORG  process  in  the  end  (see  the  proof  of 
this  claim  later),  there  will  be  a  HEAD_ORG  process 
waiting  to  take  place  whenever  — iF4  holds.  Because  the 
system’s  coverage  is  finite  and  every  HEAD_ORG 
process  is  able  to  cover  another  ( V3  R+2R,)-radius 
circular  area,  the  number  of  possible  HEAD_ORG 
process  occurrence  is  finite.  Therefore,  “F  a  I2  a  I3  a 
— iF4  leads  to  F4”  holds. 

Now,  let  us  prove  that  all  the  visible  areas  of  the 
system  can  be  covered  by  the  HEAD_ORG  process  in 
the  end.  We  prove  it  by  induction  on  the  area  encircled 
by  heads  of  i-band  away  from  the  big  node,  denoted 
Round  Area  RA(i)  (i.e.  area  of  radius  (V3R  X  i  +  Rt  + 
R)  and  i  is  the  number  of  hexagons  away  from  the  big 
node). 

Base:  when  i  =  0,  1,  clearly  holds 

Hypothesis:  the  claim  holds  when  i  =  k 

Induction:  when  i  =  (k+1), 


As  we  can  see  from  the  picture,  any  point  that  is  in 
RA(k+l)  but  not  in  RA(k)  will  be  covered  by  some 
(k+l)-band  head.  And  each  (k+l)-band  head  can  be 
taken  care  of  by  some  k-band  head,  either  directly  or 
indirectly,  even  though  some  of  them  might  not  be 
generated  directly  by  a  k-band  head  due  to  different 
progress  speeds  of  the  self-configuration  process  at 
different  directions  spreading  from  the  big  node.  Thus 
the  claim  holds  when  i  is  (k+1). 

□ 

4)  Theorem  5:  DI  is  an  invariant  of  algorithm  GS3-D, 
where  DI  =  SI  (invariant  of  GS3-S)  with  I2  relaxed 
as  above. 

•  Ip  Connectivity  (safety  property  of  head  level 
graph) 


■  1 1.1:  Any  pair  of  heads  that  are  connected  in  Gh  are 
also  connected  in  Gp,  and  vice  versa.  That  is, 

(V  vhi,  vh2  e  Vh:  there  is  a  path  between  vhl  and  vh2  in  Gh  <=> 
there  is  a  path  between  vhl  and  vh2  in  Gp) 

Proof: 

Gp  only  depends  on  the  nodes  in  the  system  and 
their  communication  capability,  thus  has  nothing  to  do 
with  the  program  actions.  Gh  only  depends  on  the  set 
of  head  nodes  in  the  system  and  the  parent-child 
relationship  among  them.  Thus  the  set  of  actions  that 
are  related  to  Gh  are  those  of  HEAD_ORG, 
HEAD_ORG_RESP,  ASSOCIATE_ORG_RESP, 
intra-cell  maintenance,  inter-cell  maintenance,  and 
system  state  sanity  check.  New  node  join  does  not 
affect  this  claim,  because  it  does  not  affect  the  head 
level  structure  directly. 

At  the  same  time,  starting  from  a  state  where  the 
Invariant  holds,  system  state  sanity  check  will  not  be 
enabled.  So,  in  proving  F.i,  we  only  need  to  prove  that 
it  is  closed  under  a  round  of  HEAD_ORG, 
HEAD_ORG_RESP,  ASSOCIATE_ORG_RESP, 
intra-cell  maintenance  and  inter-cell  maintenance. 

=>: 

In  dynamic  immobile  networks,  the  only 
modifications  to  processes  HEAD_ORG,  HEAD_ 
ORG_RESP  and  ASSOCIATE_ORG_RESP  that  could 
affect  the  claim  differently  from  that  of  the  static 
networks  is  the  case  where  an  existing  head  i  selects  a 
better  parent  head  j.  In  this  case,  there  is  an  edge  (i,  j) 
added  to  Gh.  According  to  HEAD_ORG  and 
HEAD_ORG_RESP,  head  i  and  j  are  no  more  than 

( V3  R+2R,)  away  from  each  other  and  within 
transmission  range  of  each  other.  Thus  edge  (i,  j)  must 
exist  in  Gp  too.  Therefore  the  claim  is  still  closed 
under  the  modified  HEAD_ORG,  HEAD_ 
ORG_RESP  and  ASSOCIATE_ORG_RESP  processes 
in  dynamic  immobile  networks. 

In  intra-cell  maintenance,  the  sub-modules  that 
could  affect  Gh  is  STRENGTHEN_CELL  and 
REPL ACIN G_HE AD .  STREN GTHEN_CELL  itself 
does  not  affect  Gh,  because  it  j  ust  demotes  the  current 
head  to  associate  and  promotes  another  associate  to  be 
head.  The  result  of  STREN GTHEN_CELL  is  a 
REPLACING_HEAD  process.  So  we  only  need  to 
prove  that  the  claim  is  closed  under 
REPL  ACIN  G_HE  AD .  The  way  REPL  ACIN  G_HE  AD 
works  guarantees  that  the  newly  elected  head  i  is  no 

more  than  2  V3  R  away  from  its  children  head  as  well 
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as  neighboring  heads  and  is  within  transmission  range 
of  one  another.  Therefore,  they  must  be  an  edge 
between  head  i  and  each  of  its  children  heads  in  Gp. 
Thus,  the  claim  is  closed  under  REPLAC1NG_HEAD. 

In  inter-cell  maintenance,  the  sub-modules  that  can 
affect  Gh  is  HEAD_ORG,  SYN_CELL  and  PARENT_ 
SEEK.  Since  the  claim  is  closed  under  HEAD.ORG, 
we  only  need  to  prove  that  it  is  closed  under 
SYN_CELL  and  PARENT_SEEK.  SYN_CELL  does 
not  affect  the  claim  directly  because  the  head  is  just 
removed  from  Gh-  Instead  only  SYN_CELL’s  result, 
REPLACING_  HEAD,  could  affect  the  claim.  Since 
the  claim  is  closed  under  REPLACING_HEAD,  it  is 
also  closed  under  SYN_CELL.  In  PARENT_SEEK 
initiated  by  a  head  j,  if  head  j  succeeds  in  finding  a 
neighboring  head  as  parent,  j  must  be  no  more  than 

2a/3R  away  from  its  parent  and  they  are  within 
transmission  range  of  each  other.  Thus  there  must  be 
an  edge  between  head  j  and  its  new  parent  in  Gp. 
Therefore,  the  claim  is  closed  under  PARENT_SEEK. 


By  T  2,  Gh  is  a  tree,  thus  any  two  heads  hi  and  h2 
are  connected  in  Gh  and  there  would  always  be  a  path 
between  then  in  Gh-  So  this  claim  trivially  holds. 

Therefore,  after  a  round  of  a  round  of 
HEAD_ORG,  HEAD_ORG_RESP,  ASSOCIATE. 
ORG.RESP,  intra-cell  maintenance,  inter-cell 
maintenance  and  system  state  sanity  check  execution, 
Gh  and  Gp  still  satisfy  IM. 

□ 

■  Ii.2:  Gh  is  a  tree  rooted  at  the  big  node  H0.  That  is, 

(hops(H0)  =  0)  a  (P(H0)  =  Ho)  a 

(V  V;  e  (Vh  -  { H0 } ) :  (there  is  a  path  between  v;  and  H0) 
=>  (hops(H0,  V;)  =  hops(H0,  P( v;»+ 1 )  a 

(V  Vi,  Vj  e  Vh:  there  is  a  path  between  V;  and  Vj  in  Gh)  a 

(V  v;,  Vj  e  Vh:  there  is  a  path  of  length  no  fewer  than  2 
between  Vj  and  Vj  =>  (P(V;)  +  Vj  a  P(vj)  ^  Vj)), 

where  hops(V[,  v2)  denotes  the  length  of  the  path  from  Vi 
to  v2  in  Gh. 

Proof: 

The  set  of  actions  that  are  enabled  at  an  Invariant 
state  and  that  can  affect  Gh  are  those  of  HEAD.ORG, 
HEAD.ORG.RESP,  ASSOCIATE.ORG.RESP, 
intra-cell  maintenance,  and  inter-cell  maintenance. 
New  node  join  does  not  affect  this  claim,  because  it 
does  not  affect  the  head  level  structure  directly. 


In  order  to  prove  IL2,  we  only  need  to  prove  that  it 
is  closed  under  a  round  of  HEAD.ORG, 
HEAD.ORG.RESP,  ASSOCIATE.ORG.RESP, 
intra-cell  maintenance,  and  inter-cell  maintenance. 

In  dynamic  immobile  networks,  the  only 
modifications  to  processes  HEAD.ORG,  HEAD. 
ORG.RESP  and  ASSOCIATE.ORG.RESP  that  could 
affect  the  claim  differently  from  that  of  the  static 
networks  is  the  case  where  an  existing  head  j  selects  a 
better  parent  head  k.  In  this  case,  Gh  is  still  a  tree 
because,  even  though  the  edge  between  j  and  its 
previous  head  in  Gh  is  removed,  the  added  edge  (j,  k) 
guarantees  that  the  sub-tree  rooted  at  head  j  in  Gh  is 
still  connected  to  other  nodes  in  Gh  through  head  k. 

In  intra-cell  maintenance,  the  sub-modules  that 
could  affect  Gh  is  STRENGTHEN.CELL  and 
REPLACING.HEAD.  The  result  of  STRENGTHEN. 
CELL  and  REPLACING.HEAD  is  that  one  head  j  in 
Gh  is  replaced  by  an  associate  k  in  j  ’  s  cell  that  is  not  in 
Gh  previously.  The  way  STRENGTHEN.CELL  and 
REPLACING.HEAD  work  guarantees  that  j’s 
relationship  with  its  parent  head  as  well  as  children 
heads  are  transferred  to  node  k.  Thus,  the  structure  of 
Gh  is  maintained  after  any  STRENGTHEN.CELL  or 
REPLACING.HEAD  operation,  except  that  node  j  is 
replaced  by  node  k.  So,  the  claim  is  closed  under  intra¬ 
cell  maintenance. 

In  inter-cell  maintenance,  the  sub-modules  that  can 
affect  Gh  is  HEAD.ORG,  SYN.CELL  and  PARENT. 
SEEK.  Since  the  claim  is  closed  under  HEAD.ORG, 
we  only  need  to  prove  that  it  is  closed  under 
SYN.CELL  and  PARENT.SEEK.  The  result  of 
SYN.CELL  is  that  one  head  j  in  Gh  is  replaced  by  an 
associate  k  in  j’s  cell  that  is  not  in  Gh  previously,  if 
such  k  exists.  If  such  k  really  exists,  the  way 
SYN.CELL  and  its  resulting  REPLACING.HEAD 
work  guarantees  that  j’s  relationship  with  its  parent 
head  as  well  as  children  heads  are  transferred  to  node 
k.  Thus,  the  structure  of  Gh  is  maintained  after  the 
SY.CELL  and  REPLACING.HEAD  operation.  If 
such  k  does  not  exist,  process  PARENT.SEEK  will  be 
initiated,  which  guarantees  that  the  sub-tree  previously 
rooted  at  head  j  in  Gh  will  be  connected  to  the 
remaining  part  of  Gh  if  it  is  not  completely  separated 
from  the  system.  So  Ii.2  is  still  closed  in  this  case.  As 
for  PARENT.SEEK,  it  will  be  initiated  at  head  j  only 
if  the  sub-tree  rooted  at  j  is  disconnected  from  the 
other  part  of  Gh  because  of  the  removal  of  edge  (j, 
P(j)).  The  result  of  PARENT.SEEK  is  that  this  sub¬ 
tree  gets  re-connected  to  the  remaining  Gh  if  the  sub- 
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tree  is  not  disconnected  from  the  remaining  Gh,  or  this 
sub-tree  disappears  (i.e.  all  heads  in  this  sub-tree  go  to 
boot-up  state)  if  it  is  completely  disconnected  from  the 
remaining  Gh-  Thus  IL2  is  closed  under 
PARENT_SEEK.  Therefore,  l12  is  closed  under  inter¬ 
cell  maintenance. 

Therefore,  after  a  round  of  HEAD_ORG, 
HEAD_ORG_RESP,  ASSOCIATE_ORG_  RESP, 
intra-cell  maintenance,  and  inter-cell  maintenance 
execution,  Ii.2  still  holds  if  it  held  before  the  execution 
of  these  modules. 

□ 

•  I2:  Hexagonal  map  of  heads  and  inner  cells 

■  I2.i:  Each  inner  head  i  has  exactly  6  neighboring 
heads,  and  the  6  neighboring  heads  of  head  i  forms  a 
cellular  hexagon  that  is  centered  by  head  i,  with 
bounded  vertices’  location  deviation.  That  is, 

(V  inner_head  i:  I  neighboring_heads(i)  I  =  6)  a 

(V  inner_head  i  (Vj  e  neighboring_heads(i): 

«CIC(i),ICP(i)>  =  <CIC(j),ICP(j)>)  =>  (V3R-2R,  < 
dist(i,  j)  <  V3  R+2R, )  a 

«CIC(i),ICP(i)>  A  <CIC(j),ICP(j)>)  =>  ( dist(IL(i),IL(j ))- 
2Rt  <  dist(i,  j)  <  dist(IL(i),IL(j))- I-2R,  )  a  (0  < dist(IL(i), 

IL(j))  <2  *\[3  R  ) 

) 

Proof: 

The  set  of  actions  that  are  enabled  at  an  Invariant 
state  and  that  can  affect  I2.i  are  those  of  HEAD_ORG, 
HEAD_ORG_RESP,  ASSOCIATE_ORG_RESP, 
intra-cell  maintenance,  and  inter-cell  maintenance. 
New  node  join  does  not  affect  this  claim,  because  it 
does  not  affect  the  head  level  structure  directly. 

In  order  to  prove  I2.i,  we  only  need  to  prove  that  it 
is  closed  under  a  round  of  HEAD_ORG, 
HEAD_ORG_RESP,  ASSOCIATE_ORG_RESP, 
intra-cell  maintenance,  and  inter-cell  maintenance. 

In  dynamic  immobile  networks,  the  only 
modifications  to  processes  HEAD_ORG,  HEAD_ 
ORG_RESP  and  ASSOCIATE_ORG_RESP  that  could 
affect  the  claim  differently  from  that  of  the  static 
networks  is  the  case  where  an  existing  head  j  selects  a 
better  parent  head  k.  Even  in  this  case,  I2.i  should  still 
be  closed  under  a  round  of  head  organization  process, 
because  it  affects  neither  j’s  nor  k’s  geographical 
location.  Also,  in  dynamic  immobile  networks,  a 
HEAD_ORG  process  will  be  initiated  by  a  head  j  only 


if  j  and  its  parent  head  P(j)  are  at  the  same  <CIC,  ICP> 
point  within  their  respective  cells.  Under  this  premise, 
the  next  band  head  organization  process  acts 
essentially  the  same  as  that  in  static  networks  in  terms 
of  head  level’s  hexagonal  feature.  So,  I2.i  is  closed 
under  a  round  of  HEAD_ORG,  HEAD_ORG_RESP 
and  ASSOCIATE_ORG_RESP  execution  in  dynamic 
immobile  networks. 

In  intra-cell  maintenance,  the  sub-modules  that  can 
affect  head  level  structure  are  REPLACING_HEAD 
and  STRENGTHEN_CELL.  The  result  of 
REPLACING_HEAD  is  that  one  head  j  in  a  cell  is 
replaced  by  a  head  candidate  k  in  j’s  cell  that  is  no 
more  than  R,  away  from  the  ideal  location  of  this  cell. 
The  way  REPLACING_HEAD  works  guarantees  that 
j’s  relationship  with  its  neighboring  heads  is 
transferred  to  node  k.  Thus,  I2.i  is  closed  under  any 
round  of  REPLACING_HEAD.  The  result  of 
STRENGTHEN_  CELL  initiated  by  a  head  j  is  that  j 
retreats  to  be  an  associate  node  and  another  associate 
node  k  previously  in  j’s  cell  become  the  head  of  this 
cell.  If  the  newly  elected  head  k  is  at  the  same  <CIC, 
ICP>  point  as  its  neighboring  cell’s  head  m,  they  are  at 
the  same  relative  location  to  their  respective  OIL,  with 
on  more  than  R,  location  deviation.  According  to  the 
HEAD_ORG,  HEAD_ORG_RESP  and 

ASSOCIATE_ORG_RESP,  the  original  ideal  location 

(OIL)  of  any  two  neighboring  cells  is  exactly  yf3  R. 
Therefore,  the  distance  between  k  and  m  should  be 
V3  R  with  no  more  than  2Rt  deviation,  the  same  as 
that  in  static  networks.  However,  if  k  and  m  are  at 
different  <CIC,  ICP>  points,  this  regularity  does  not 
hold  any  more.  But  the  distance  between  k  and  m  is 

still  no  more  than  2  V3  R,  because  the  way 
STRENGTHEN_CELL  works  guarantees  that  the 
maximum  distance  between  any  possible  ILs  of  two 

neighboring  cells  is  no  more  than  2  V3  R.  So,  the  I21  is 
closed  STRENGTHEN_CELL  too.  In  a  word,  I2.i  is 
closed  under  intra-cell  maintenance. 

In  inter-cell  maintenance,  the  sub-modules  that  can 
affect  head  level  structure  are  HEAD_ORG, 
SYN_CELL  and  PARENT_  SEEK.  Since  the  claim  is 
closed  under  HEAD_ORG,  we  only  need  to  prove  that 
it  is  closed  under  SYN_CELL  and  PARENT_SEEK. 
The  result  of  SYN_CELL  is  that  one  head  j  is  replaced 
by  an  associate  k  in  j’s  cell,  if  such  k  exists.  If  such  k 
really  exists,  the  way  SYN_CELL  and  its  resulting 
REPLACING_HEAD  work  guarantees  that  j’s 
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relationship  with  its  neighboring  heads  is  transferred  to 
node  k.  Thus,  I2.i  closed  under  SY_CELL  and  its 
resulting  REPLACING_HEAD  operations.  If  such  k 
does  not  exist,  process  PARENT_SEEK  will  be 
initiated.  As  for  PARENT_SEEK,  it  will  be  initiated  at 
head  j  only  if  the  sub-tree  rooted  at  j  is  disconnected 
from  the  other  part  of  Gh  because  of  the  removal  of 
edge  (j,  P(j))  in  Gh.  The  result  of  PARENT_SEEK  will 
not  add  any  new  head  to  the  system  or  change  the 
location  of  any  existing  heads,  even  though  it  might 
remove  some  existing  heads  from  the  head  level  graph. 
Thus  1 1.2  must  be  closed  under  PARENT_SEEK. 
Therefore,  I2.i  is  closed  under  inter-cell  maintenance. 

Based  upon  the  analysis  above,  after  a  round  of 
HEAD_ORG,  HEAD.ORG.RESP,  ASSOCIATE. 
ORG.RESP,  intra-cell  maintenance,  and  inter-cell 
maintenance  execution,  I2.i  still  holds  if  it  held  before 
the  execution  of  these  modules. 

□ 


distance  between  boundary  head  i  and  its  neighboring 
heads  is  bounded  in  the  same  way  as  inner  head  does. 

□ 

■  I23:  Each  head,  except  for  the  big  node,  has  no  more 
than  5  children  heads.  The  big  node  H0  has  6 
children  heads  if  it  is  not  on  the  system’s  boundary 
and  it  would  have  1~5  children  heads  if  it  is  on  the 
boundary  of  the  system  but  not  disconnected  from 
the  small  nodes.  That  is, 

(V  head  i:  I  CH(i)  I  <  5  )  a 

(H0  is  not  on  the  boundary  of  system  coverage  =>  (  ICH(H0)l  =  6 
))  A 

(H0  is  on  the  boundary  of  system  coverage  but  not  disconnected 
=>(1^1  CH(Ho)  I  <  5  )) 

Proof: 

Since  both  I21  and  I22  are  invariants,  and  I21  a  I22 
=>  I2  3,  12  3  is  an  invariant  too. 

□ 


■  I2.2:  Each  boundary  head  i  has  less  than  6 
neighboring  heads,  and  the  distance  between  i  and  its 
neighboring  heads  is  hexagonally  bounded.  That  is, 

(V  boundary_head  i:  I  neighboring_heads(i)  I  <  6)  a 

(V  boundary_head  i  (Vj  e  neighboring_heads(i): 

(<CIC(i),ICP(i)>  =  <CIC(j),ICP(j)>)  =>  (V3R-2R,  < 
dist(i,  j)  <  -\/3  R+2R, )  a 

«CIC(i),ICP(i)>  *  <CIC(j),ICP(j)>)  =>  ( dist(IL(i),IL(j ))- 
2R,  <  dist(i,  j)  <  dist(IL(i),IL(j))+ 2Rt  )  a  (0  < 

dist(IL(i),  IL(j))  <2yf?>R) 

) 

Proof: 

Since  we  have  proved  that  I2.i  is  an  invariant,  we 
just  need  to  prove  that  I2 1  =>  I2  2  in  proving  that  I2.2  is 
an  invariant.  The  proof  of  I2 1  =>  I2.2  is  as  follows: 

Boundary  heads  are  generated  and  maintained  (by 
intra-cell  as  well  as  inter-cell  maintenance  procedure) 
in  the  same  way  as  inner  heads.  The  only  difference  is 
that  their  cells  are  on  the  boundary  of  the  system’s 
geographic  coverage  such  that  there  is  no  neighboring 
head  in  certain  (60+2a)°  region  around  itself,  where  a 
denotes  the  angular  deviation  corresponding  to  the  Rt 
head’s  location  deviation.  Since  each  inner  head  has 

exactly  6  neighboring  heads  in  its  ( V3  R+2Rt)  radius, 
each  boundary  head  should  have  less  than  6 
neighboring  heads  in  its  ( V3  R+2Rt)  radius.  And  the 


■  I2.4:  Each  cell  is  of  radius  (R+Rrand0m)-  When  a  cell  i 
and  all  its  neighboring  cells  are  at  the  same  <CIC, 


ICP>  point,  IRrandom 


I  is  no  more  than  — ■=  Rt  for  inner 
a/3 


cell  i  and  no  more  than  ((A/3-l)R+2Rt+dp)  for 
boundary  cells,  with  dp  being  the  diameter  of  the 
gap-perturbed  area  adjoining  a  boundary  cell  (dp  is  0 
if  there  is  no  gap-perturbed  area).;  Otherwise, 
\P  random  I  A  less  than  (2R+Rt)  for  inner  cell  i.  This 
also  means  that  each  associate  node  is  of  (R+Rrandom) 
distance  to  its  head.  That  is, 

(V  inner  cell  C(i): 


( 'vj eneighboring_heads(i ):  (<CIC(i),ICP(i)>  =  <CIC(j),ICP(j)>) 

2 

=>  (V  associate  ie  C:  dist(i,  H(i))  <  R+ — -j=  R,)) 

a/3 


A 

(3  j e neighboring _heads(i):  (<CIC(i),ICP(i)>  3  <CIC(j),ICP(j)>) 
=>  (V  associate  ie  C:  dist(i,  H(i))  <  2R+Rt) 

) 

A 

(V  boundary  cell  C(i):  (V  associate  i  e  C(i)  :  dist(i,  H(i))  <  R’))  a 
(R’  <  V3R+2Rt+dp)) 


Proof: 

As  for  inner  cell  C(i),  we  could  prove  the  claim  is 
closed  under  program  actions  by  proving  that  I2.i  a  I22 
a  I3  =>  (I2  4  for  inner  cell).  The  proof  is  as  follows: 
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Case  one:  Vje  neighboring_heads(i):  <CIC(i), 
ICP(i)>  =  <CIC(j),ICP(j)> 

The  proof  is  the  same  as  that  for  static  networks, 
we  neglect  it  here  for  simplicity. 

Case  two:  3  jeneighboring_heads(i):  <CIC(i), 
ICP(i)>  *  <CIC(j),ICP(i)> 

In  this  case,  the  worst  scenario  for  an  associate 
node  j  in  an  inner  cell  is  as  the  following  figure 
shows: 


That  is,  the  three  heads  (HO,  HI  and  H2)  are 
farthest  away  from  one  another  (2  V3  R).  But  the 
maximum  distance  between  j  and  any  of  these 
three  heads  is  still  no  more  than  2R  with  possible 
Rt  location  deviation  by  geometry  calculation. 

As  for  boundary  cells,  the  set  of  actions  that  are 
possibly  enabled  at  invariant  state  and  that  can  affect 
l2.4  for  boundary  cells  are  those  of  HEAD_.ORG, 
ASSOCIATE_ORG_RESP,  new  node  joins,  intra-cell 
maintenance  and  inter-cell  maintenance. 

As  proved  in  static  networks,  I24for  boundary  cells 
is  closed  under  HEAD_ORG  and 
ASSOCIATE_ORG_RESP  operations. 

I2.4  for  boundary  cells  is  closed  under  new  node 
join  operation  too,  because  new  node  join  does  not 
creat  new  heads,  and  the  way 
SM  ALL_N  ODE_B  OOT_UP  and 

SMALL_NODE_JOIN  work  guarantees  that  the 
distance  between  the  new  node  and  its  selected  head  is 

no  more  than  MAX+(  yf3  R+2Rt). 

In  intra-cell  maintenance,  the  sub-modules  that  can 
affect  I2.4  for  boundary  cells  are  REPLACING_HEAD 
and  STRENGTHEN_CELL.  The  result  of 
REPLACING_HEAD  is  that  one  head  j  in  a  cell  is 
replaced  by  a  head  candidate  k  in  j’s  cell  that  is  no 
more  than  Rt  away  from  the  ideal  location  of  this  cell. 
Thus,  I2  4  for  boundary  cells  is  closed  under  any  round 
of  REPLAC1NG_HEAD.  The  result  of 
STRENGTHEN_  CELL  initiated  by  a  head  j  is  that  j 
retreats  to  be  an  associate  node  and  another  associate 


node  k  previously  in  j’s  cell  become  the  head  of  this 
cell.  Before  the  execution  of  STRENGTHEN_CELL, 
the  maximum  distance  between  j’s  cell’s  original  ideal 
location  and  any  associate  in  this  cell  is  no  more  than 

MAX+(V3R+2Rt).  after  the  STRENGTHEN_CELL 
operation,  the  distance  between  k  and  this  cell’s 
original  ideal  location  is  no  more  than  R.  So  after  the 
STRENGTHEN_CELL  operation,  the  maximum 
distance  between  k  and  any  associate  in  its  cell  is  no 

more  than  MAX+(  V3  R+2R,)+R.  So  I2  4  for  boundary 
cells  is  closed  under  STRENGTHEN_CELL.  In  a 
word,  I2  4  for  boundary  cells  is  closed  under  intra-cell 
maintenance. 

In  inter-cell  maintenance,  the  sub-modules  that  can 
affect  I2  4  for  boundary  cells  are  HEAD_ORG, 
SYN_CELL  and  PARENT_  SEEK.  Since  the  claim  is 
closed  under  HEAD_ORG,  we  only  need  to  prove  that 
it  is  closed  under  SYN_CELL  and  PARENT_SEEK. 
The  result  of  SYN_CELL  is  that  one  head  j  is  replaced 
by  an  associate  k  in  j’s  cell,  if  such  k  exists.  If  such  k 
really  exists,  the  way  SYN_CELL  and  its  resulting 
REPLACING_HEAD  work  guarantees  that  I24  for 
boundary  cells  still  holds  after  the  execution,  in  the 
same  way  as  STRENGTHEN_CELL.  Thus,  I24  for 
boundary  cells  is  closed  under  SY_CELL  and  its 
resulting  REPLACING_HEAD  operations.  If  such  k 
does  not  exist,  any  associate  in  j’s  cell  goes  back  to 
boot-up  state  and  acts  as  a  new  node  joining  the 
system,  where  I24  for  boundary  cells  is  also  closed.  So 
I24for  boundary  cells  is  closed  under  SYN_CELL.  As 
for  PARENT_SEEK,  it  will  be  initiated  at  head  j  only 
if  the  sub-tree  rooted  at  j  is  disconnected  from  the 
other  part  of  Gh  because  of  the  removal  of  edge  (j, 
P(j))  in  Gh.  The  result  of  PARENT_SEEK  will  not  add 
any  new  head  to  the  system  or  change  the  location  of 
any  existing  heads,  even  though  it  might  remove  some 
existing  heads  from  the  head  level  graph,  which  will 
initiate  new  node  joins  operation.  But  all  this  does  not 
violate  I24  for  boundary  cells.  Thus  I24  for  boundary 
cells  must  be  closed  under  PARENT_SEEK. 
Therefore,  I2  4  for  boundary  cells  is  closed  under  inter¬ 
cell  maintenance. 

□ 

•  I3:  Inner  Cell  Optimality  (for  associate  nodes) 

■  Each  associate  node  in  an  inner  cell  chooses  the  best 
(closest,  most  remaining  energy,  etc.)  neighboring 
head  to  join.  That  is, 

(V  associate  i  in  any  inner  cell:  V  head  j  ^  H(i)  (H(i)  better  than  j)) 


13 


Proof: 

The  set  of  actions  that  are  possibly  enabled  at 
invariant  state  and  that  can  affect  I3  are  those  of 
HEAD_.ORG,  ASSOCIATE_ORG_RESP,  new  node 
join,  intra-cell  maintenance,  and  inter-cell 
maintenance. 

As  proved  for  static  networks,  I3  is  closed  under 
HEAD_ORG  and  ASSOCIATE_ORG_RESP. 

I3  is  closed  under  new  node  join  operation  because 
in  SM ALL_N ODE_B  OOT_UP  and  SMALL_NODE_ 
JOIN,  a  new  node  always  choose  the  best  neighboring 
head  to  associate.  In  SMALL_NODE_BOOT_UP  and 
SMALL_NODE_JOIN,  a  new  node  might  join  a 
neighboring  head’s  HEAD_ORG  process,  but  in  this 
case,  the  new  node  is  in  a  boundary  cell,  either  at  an 
inner  gap  or  at  real  system  boundary.  Therefore,  I3  is 
closed  under  new  node  join  scenario. 

In  intra-cell  maintenance,  the  sub-modules  that  can 
affect  I3  are  REPLACING_HEAD  and 
STRENGTHEN_CELL.  The  result  of  REPLACING_ 
HEAD  is  that  one  head  j  in  a  cell  is  replaced  by  a  head 
candidate  k  in  j’s  cell.  At  the  moment  k  assumes  the 
head  role,  it  will  broadcast  a  Head_intra_alive  message 
that  guarantees  that  any  associate  that  k  can  serve  as  a 
better  head  will  choose  k  as  the  new  better  head.  Thus, 
I3  is  closed  under  any  round  of  REPLACING_HEAD. 
The  result  of  STRENGTHEN_  CELL  initiated  by  a 
head  j  is  the  same  as  REPLACING_HEAD  from  the 
point  of  view  of  I3.  So  I3  is  closed  under 
STRENGTHEN_CELL.  In  a  word,  I3  is  closed  under 
intra-cell  maintenance. 

In  inter-cell  maintenance,  the  sub-modules  that  can 
affect  I3  are  HEAD_ORG,  SYN_CELL  and  PARENT_ 
SEEK.  Since  I3  is  closed  under  HEAD_ORG,  we  only 
need  to  prove  that  it  is  closed  under  SYN_CELL  and 
PARENT_SEEK.  The  result  of  SYN_CELL  is  that  one 
head  j  is  replaced  by  an  associate  k  in  j  ’  s  cell,  if  such  k 
exists.  If  such  k  really  exists,  the  result  of  SYN_CELL 
and  its  resulting  REPLAC1NG_HEAD  is  the  same  as 
that  of  REPL ACIN G_HE AD  from  the  I3’s  point  of 
view.  Thus,  I3  is  closed  under  SYN_CELL  and  its 
resulting  REPLACING_HEAD  operations.  If  such  k 
does  not  exist,  any  associate  in  j’s  cell  goes  back  to 
boot-up  state  and  acts  as  a  new  node  joining  the 
system,  where  I3  is  also  closed.  So  I3  is  closed  under 
SYN_CELL.  As  for  PARENT_SEEK,  it  will  be 
initiated  at  head  j  only  if  the  sub-tree  rooted  at  j  is 
disconnected  from  the  other  part  of  Gh  because  of  the 


removal  of  edge  (j,  P(j))  in  Gh.  The  result  of 
PARENT_SEEK  will  not  add  any  new  head  to  the 
system  or  change  the  location  of  any  existing  heads, 
even  though  it  might  remove  some  existing  heads  from 
the  head  level  graph,  which  will  initiate  new  node 
joins  operation.  But  all  this  does  not  violate  I3.  Thus  I3 
must  be  closed  under  PARENT_SEEK.  Therefore,  I3  is 
closed  under  inter-cell  maintenance. 

□ 

5)  Theorem  1:  Starting  from  any  state,  every 
computation  of  GS-D  reaches  a  state  where  D1 
holds  within  time  0(DC),  where  Dc  is  the  diameter 
of  a  continuous  state -corrupted  area..  That  is, 

TRUE  leads  to  Invariant  (Ii  aI2a  I3) 

Proof: 

In  order  to  prove  “TRUE  leads  to  Invariant”,  we 

just  need  to  prove  “ Invariant  leads  to  Invariant” 
because  “Invariant  leads  to  Invariant”  is  obvious.  The 
proof  is  as  follows. 

There  are  two  cases  where  Invariant  could  be 
reached  due  to  node  failure,  even  though  it  cannot  be 
reached  just  program  actions. 

a)  A  head  j  dies  without  following  proper  head 
retreat  procedure 

This  kind  of  failure  may  make  Gh  disconnected 
temporarily,  thus  affects  connectivity  (I12).  This 
could  be  dealt  with  by  inter-cell  maintenance 
procedures.  By  inter-cell  maintenance  procedure, 
the  parent  head  P(j)  of  head  j  will  first  initiate 
another  round  of  HEAD_ORG  process,  trying  to 
recover  the  failure  of  head  j .  If  there  is  any  node  in 
head  j’s  original  Rt-radius  range,  the  HEAD_ORG 
process  will  succeed  in  finding  a  replacing  head  k 
to  play  the  role  head  j  previously  did.  Thus  this 
will  make  Gh  connected  again.  If  it  fails,  the  sub¬ 
trees  previously  rooted  at  head  j  will  initiate 
PARENT_SEEK.  This  will  make  these  sub-trees 
connected  to  the  remaining  Gh  if  they  are  not 
completely  disconnected  from  the  remaining  Gh.  If 
they  are  really  disconnected  from  the  remaining 
Gh,  all  heads  in  the  sub-tree  will  retreat  to  boot-up 
state,  which  also  makes  I12  true  again.  Time 
complexity  is  0(A),  where  A  stands  for  the  size  of 
the  contiguously  affected  area. 

This  failure  can  also  make  all  the  associates 
originally  in  its  cell  live  without  a  head,  even 
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though  they  still  have  their  head  pointer  point  to 
node  j.  So  the  inner  cell  optimality  (I3)  is  violated 
here  too.  This  could  be  dealt  with  by  intra-cell 
maintenance.  Any  associate  k  previously  in  head 
j  ’  s  cell  will  go  back  to  boot-up  state  after  detecting 
that  their  head  has  died.  Then 
SMALL_NODE_BOOT_UP  process  will  be 
initiated  at  node  k,  which  makes  I3  hold  for  node  k 
again.  On  the  other  hand,  before  node  k  goes  back 
to  boot-up  state,  if  it  hears  Head_intra_alive 
message  from  another  head  m  other  than  j  and  k 
considers  m  being  better  than  j,  node  k  will  choose 
head  m  as  its  head.  Thus  still  makes  I3  holds  again. 
The  time  complexity  of  this  process  is  9(Ci), 
where  Ci  is  a  small  constant  related  to  the  purely 
one-hop  message  exchange. 

b)  State  corruption  at  existing  head  node  or 
associate  node  j 

This  can  affect  connectivity  (Iu)  because  the 
corrupted  head  j  might  choose  a  random  number  as 
P(j)  and  P(j)  is  the  ID  of  another  head,  but  P(j)  and 
j  are  beyond  the  transmission  range  of  one  another. 
This  could  be  dealt  with  by  inter-cell  maintenance. 
Since  j  cannot  hear  Head_inter_alive  message 
from  P(j),  it  will  initiate  PARENT_SEEK  to  find 
another  head  to  associate,  which  will  make  Iu  true 
again.  The  time  complexity  of  this  process  is 
0(C2),  where  C2  is  a  small  constant  related  to  Tphbt 
and  the  purely  one-hop  message  exchange  in 
PARENT_SEEK  (we  assume  head  j’s  original 
parent  is  still  there  and  j  has  heard 
Head_inter_alive  message  from  it). 

This  can  affect  hexagonal  head  level  structure 
(I2)  because  head  j’s  CH(j)  might  be  corrupted, 
because  head  j  will  not  hear  Head_inter_alive 
message  from  its  mistakenly-elected  child  head, 
which  will  make  head  j  initiate  a  HEAD_ORG 
process  even  though  it  should  not  be.  This  will 
generate  a  head  that  should  not  be  a  head  indeed.  It 
could  be  dealt  with  by  system  state  sanity  check, 
as  discussed  in  c).  Time  complexity  is  9(A),  where 
A  stands  for  the  size  of  the  contiguously  affected 
area. 

This  can  affect  inner  cell  optimality  (I3) 
because  an  associate  j’s  H(j)  could  be  corrupted 
such  that  H(j)  is  either  not  the  best  or  is  beyond 
transmission  range.  This  could  be  dealt  with  by 
intra-cell  maintenance  at  the  moment  associate  j 


hears  its  neighboring  heads’  Head_intra_alive 
messages.  The  time  complexity  of  this  process  is 
$fC3),  where  C3  is  a  small  constant  related  to  the 
purely  one-hop  message  exchange. 

c)  A  new  head  j  shows  up  due  to  state 
corruption,  or  due  to  HEAD_.ORG  initiated  by  a 
corrupted  head,  even  though  it  should  not  be  a 
head 

It  can  affect  the  hexagonal  head  level  structure 
(I2),  because  an  extra  head  shows  up  in  the 
previously  hexagonal  head  map,  which  corrupts 
the  hexagon  feature.  This  could  be  dealt  with  by 
system  state  sanity  check.  Time  complexity  is 
9(A),  where  A  stands  for  the  size  of  the 
contiguously  affected  area. 

d)  Intra-cell  maintenance  at  cell  j  fails  to  find  a 
replacing  head  for  this  cell 

The  effect  and  the  recovery  process  is  the 
same  as  case  a). 

According  to  the  analysis  above,  “TRUE  leads  to 

Invariant”  hold. 

□ 

6)  Theorem  8:  Starting  from  any  state  where  DI 
holds,  every  computation  of  GS-D  reaches  a  state 
where  DF  holds  within  time  0(max{(Dd/ci),  Td}), 
where  c  i  is  the  average  speed  of  message  diffusing 
and  Td  is  the  maximum  difference  between  the 
lifetime  of  the  candidate  set  of  two  neighboring 
cells.  That  is, 

Invariant  (lx  a  I2  a  I3)  leads  to  Fix  Point  (F,  a 

F2  a  F3  a  F4) 

Proof: 

a)  Invariant  (Ij  a  I2  a  I3)  leads  to  F3 

We  only  need  to  prove  that  T  a  I2  a  I3  a 
F3  leads  to  “F3  for  boundary  cell”,  since  F3  naturally 

leads  to  F3,  I ,  as  well  as  I2  is  invariant,  and  I3  =>  “F3 
for  inner  cell”. 

Same  as  that  in  static  networks,  for  any  associate 
node  i  in  a  coundary  cell,  the  scenario  where  F3 

could  hold  is  when  some  better  neighboring  head  j 
around  it  is  still  at  state  qhead  and  has  not  carried  out 
the  process  HEAD_ORG  yet.  Because  HEAD_ORG 
and  HEAD_ORG_RESP  guarantee  that  two 

neighboring  heads  within  ( V3  R+2Rt)  range  cannot 
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initiate  HEAD_ORG  in  parallel,  associate  i  is  able  to 
hear  the  ORG  messages  from  all  its  neighboring 
heads,  including  head  j.  The  way 
ASSOC IATE_ORG_RESP  works  guarantees  that 
associate  i  will  choose  the  best  (such  as  closest, 
highest  remaining  energy,  etc.)  head  to  associate 
with  after  all  such  better  heads  js  finish  their 

HEAD_ORG  process.  So  F3  will  be  false  and  F3 

will  be  true  after  all  the  better  neighboring  heads 
around  associate  i  finish  their  HEAD_ORG 
processes. 

Suppose  the  number  of  better  heads  around 
associate  i  is  BETTER_HEAD  when  F3  is  true. 

Then  BETTER_HEAD  is  no  less  than  0.  When  F3 

is  true,  at  least  one  HEAD_.ORG  process  is  enabled, 
and  whenever  a  HEAD_ORG  process  finishes,  the 
value  of  BETTER_HEAD  will  decrease  by  1 .  Thus, 
it  only  takes  BETTER_HEAD  rounds  of 
HEAD_ORG  process  for  associate  i  to  transfer  from 

state  F,  to  state  F3,  which  is  a  finite  procedure. 

Thus  “T  a  I2  a  F3  leads  to  F3”  holds. 

Since  it  only  takes  finite  time  Chead_org  for  a 
HEAD_.ORG  process  to  finish,  the  state  transition 

from  F3  to  F3  would  only  take  BETTER_HEAD  x 

(Chead_org  +  Cgap)  (i.e.  0(BETTER_HEAD))  amount 
of  time,  where  Cgap  denotes  the  maximum  interval 
between  two  neighboring  heads’  HEAD_ORG 
process. 

b)  Invariant  (I3  a  I2  a  I3)  leads  to  Fj  a  F2 

If  we  could  prove  that  T  leads  to  Fi,  I2  leads  to 
(F2.i  a  F2  2  a  F24)  and  I2  a  Fi.2  =>  F2  3,  then  “Invariant 
(Ii  a  I2  a  I3)  leads  to  Fi  a  F2”  would  hold  too. 

First,  let  us  prove  “T  leads  to  Fi”. 

Because  Fi  is  equal  to  (I|  a  (V  v;  e  (Vh  -  { H0 } ) : 
D(vi)  =  MIN(H0,  vi)))  and  T  is  an  invariant,  we  just 
need  to  prove  that  “T  leads  to  (V  v;  e  (Vh  -  { H0 } ) : 
D(Vi)  =  MIN(H0,  vi))”. 

This  is  proved  by  induction  on  MIN(H0,  Vi). 

Base:  when  M1N(H0,  v,j  =  0,  Vj  is  the  big  node 
H0.  It  is  trivially  true  the  D(H0)  =  0. 

Hypothesis:  the  claim  holds  when  MIN(H0,  v,j 
=  d 

Induction:  when  MIN(H0,  v,J  =  (d+1) 


We  only  need  to  prove  that  for  any  head  v*, 
if  M1N(H0,  vO  =  (d+1),  then  D(vO  =  (d+1).  From 
HEAD_ORG_RESP  and  HEAD_INTER_CELL, 
a  head  v,  will  choose  the  a  head  with  lowest 
distance  to  H0  as  parent  head,  by  listening  to 
their  Head_org  or  Head_inter_alive  message. 
For  any  head  v*,  if  MIN(H0,  v,j  =  (d+1),  then  the 
closest  neighboring  head  j  must  have  a  M1N(H0, 
j)  value  of  d,  which  also  means  that  D(j)  =  d  by 
the  hypothesis.  Thus  D(vO  must  be  (d+1)  since  j 
is  v^s  parent  head. 

Then,  let  us  prove  “I2  leads  to  (F2  i  a  F2  2  a 

f2.4)”. 


Let’s  first  prove  that  I2  leads  to  F24  a  F22. 
Because  of  SYN_CELL,  all  heads  in  the  system  will 
have  the  same  <CIC,  ICP>  value  at  fix  point  (stable 
system  state),  that  is,  I2  leads  to  (V  head  i  (Vj  e 
neighboring_heads(i):  (<CIC(i),ICP(i)>  = 

<CIC(j),ICP(j)>).  At  the  same  time  (I24  a  I2.2  a  (V 
head  i  (Vj  e  neighboring_heads(i):  (<CIC(i),ICP(i)> 
=  <CIC(j),ICP(j»)  =>  F2.i  a  F2.2,  and  I2  is  an 
invariant.  So  “I2  leads  to  F24  a  F22”  naturally  holds 
due  to  transitivity  of  leads  to  operation. 


Now  let’s  prove  I2  leads  to  F24.  We  achieve  this 
by  proving  I2  =>  F24.  Because  I24  =  F24  a  (There  is 

2 

no  Rt  -radius  gap  in  the  system  =>  R’  <  R+— =  Rt), 

V3 

we  only  need  to  prove  that  T  a  I2  a  I3  =>  (There  is  no 

2 

Rt  -radius  gap  in  the  system  =>  R’  <  R-i — —  Rt). 

V3 

According  to  the  way  HEAD_ORG  works,  the 
boundary  cell  would  be  no  bigger  than  the  inner  cell, 
if  there  is  no  Rt  -radius  gap.  Otherwise,  the 
HEAD_ORG  process  will  be  continuously  initiated. 
Thus  the  boundary  cell’s  radius  is  still  no  more  than 
2 

(R+  —j=  Rt)  according  to  E 4  that  says  any  inner  cell’s 

V3 


radius  is  no  more  than  (R+  — =  Rt). 

s 


Finally,  let  us  prove  “I2  a  F [  2  =>  F2  3”. 

Since  F2.3  -  (I2.3  a  (V  head  i:  I  CH(i)  I  <  3  )),  we 
only  need  to  prove  that  “I2  a  F12  =>  (V  head  i:  I 
CH(i)  I  <  3)”. 

Let  us  consider  any  head  (not  big  node)  i  without 
loss  of  generality.  By  I2,  there  could  be  at  most  6 
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neighboring  heads  around  head  i,  its  possible 
children  heads  ii,  i2,  i3,  its  parent  head  P(i),  and  the 
two  neighboring  heads  (pu,  pB)  at  the  same  band  that 
are  also  under  the  care  of  P(i)  as  shown  in  the 
picture  below. 


P(i) 


By  F1.2,  pii,  pa  certainly  will  not  choose  head  i  as 
parent  because  of  the  existence  of  head  P(i)  that  is 
closer  to  H0  than  head  i.  It  is  also  trivially  true  that 
P(i)  cannot  be  the  child  of  head  i.  Therefore,  there 
could  be  at  most  three  heads  (i|,  i2,  i3)  that  could 
serve  as  head  i’s  children  heads.  Thus  I2  a  Fi.2  =>  (V 
head  i:  I  CH(i)  I  <  3). 

c)  Invariant  (lx  aI2a  I3)  leads  to  F4 

We  only  need  to  prove  that  T  a  I2  a  I3  a  F4 
leads  to  F4,  since  it  is  obvious  that  Ii  a  I2  a  I3  a  F4 
leads  to  F4.  We  need  to  prove  that  “T  a  I2  a  I3  a  F4 
leads  to  F4”  holds  both  in  the  initial  phase  of  head 
organization  diffusion  and  in  later  new  node  joins. 

In  the  case  of  new  node  j  joining  the  system, 
S  M  ALL_N  ODE_B  OOT_UP  and  SMALL_ 
NODE_JOIN  guarantee  that  node  j  will  find  an 
existing  node  as  head  or  surrogate  head  if  it  is  not 
completely  disconnected  from  the  system,  i.e.  being 
a  visible  node.  Thus  F4  will  be  reached  within  6( C) 
amount  of  time,  where  C  is  a  small  constant  related 
to  the  purely  one-hop  message  exchange. 

In  the  initial  phase  of  head  organization  process, 
since  the  way  HEAD_ORG  works  guarantees  that  all 
the  visible  areas  of  the  system  could  be  covered  by 
the  HEAD_.ORG  process  in  the  end  (see  the  proof  of 
this  claim  later),  there  will  be  a  HEAD_ORG 

process  waiting  to  take  place  whenever  F4  holds. 
Because  the  system’s  coverage  is  finite  and  every 
HEAD_ORG  process  is  able  to  cover  another 

( V3  R+2Rt)-radius  circular  area,  the  number  of 
possible  HEAD_ORG  process  occurrence  is  finite. 
Therefore,  “T  a  I2  a  I3  a  F4  leads  to  F4”  holds. 


Now,  let  us  prove  that  all  the  visible  areas  of  the 
system  could  be  covered  by  the  HEAD_ORG 
process  in  the  end.  We  prove  it  by  induction  on  the 
area  encircled  by  heads  of  i-band  away  from  the  big 
node,  denoted  Round  Area  RA(i)  (i.e.  area  of  radius 

(V3R  x  i  +  Rt  +  R)  and  i  is  the  number  of  hexagons 
away  from  the  big  node). 

Case  one:  when  there  is  no  Rt  circular  region  gap 
in  node  deployment 

Base:  when  i  =  0,  1,  clearly  holds 
Hypothesis:  the  claim  holds  when  i  =  k 
Induction:  when  i  =  (k+1), 


As  we  could  see  from  the  picture,  any 
point  that  is  in  RA(k+l)  but  not  in  RA(k)  will 
be  covered  by  some  (k+l)-band  head.  And 
each  (k+l)-band  head  could  be  taken  care  of 
by  some  k-band  head,  either  directly  or 
indirectly,  even  though  some  of  them  might 
not  be  generated  directly  by  a  k-band  head  due 
to  different  progress  speeds  of  the  self¬ 
configuration  process  at  different  directions 
spreading  from  the  big  node.  Thus  the  claim 
holds  when  i  is  (k+1). 

Case  two:  when  there  is  some  Rt  circular  region 
gap  in  node  deployment 

Base:  when  i  =  0,  1,  clearly  holds 
Hypothesis:  the  claim  holds  when  i  =  k 
Induction:  when  i  =  (k+1), 

When  there  is  only  one  Rt  circular 
region  gap  at  k-band,  we  could  see  that  the 
three  next-band  heads,  i.e.  H(k+i,i,  H(k+i)2  and 
H  (k+i,,  could  be  taken  care  of  by  the  help  of 
the  two  k-band  heads  that  are  neighboring  the 
gap.  Thus  the  claim  still  holds  in  this  case. 
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When  there  are  multiple  Rt  circular 
region  gaps  at  k-band,  we  could  see  the  same 
results  just  in  the  same  way  as  above,  and  no 
matter  whether  these  gaps  are  contiguous  or 
not.  For  simplicity  reason,  we  do  not  detail  it 
here. 

According  to  the  proof  in  a),  b),  c),  and  d),  the 
claim  that  Invariant  (F  a  I2  a  I3)  leads  to  the  fix  point 
(F[  a  F2  a  F3  a  F4)  holds. 

□ 
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